Permissions, human approval, prompt injection boundaries, auditability and operational failure modes.