Control the action.
Inspect the outcome.

Delegate under one set of limits.

Agents operate under a parent authority. Budget reservations are checked across the delegation chain, so parallel agents do not multiply the available budget.

Unknown external outcomes retain their holds until reconciliation establishes what happened.

Approve the exact request.

Bind the requester, supplier, amount and canonical request details to the action. A separate authenticated approver reviews requests above the configured threshold.

Organization roles are provisioned on the server; the browser does not assign itself authority.

Separate recovery from permission.

Queue work durably and consume a dispatch permit before the external call. A runtime retry keeps the logical action binding; restoring a checkpoint does not itself authorize another write.

PostgreSQL scheduling, background reconciliation and restore behavior require deployment-specific validation.

Unknown and conflict are different.

Read back target evidence against the intended action. Missing confirmation remains unknown. A contradictory receipt remains conflict. Both block another dispatch until the appropriate evidence and authorization requirements are met.