Data classification → Tool allowlist → Permission scope → Approval gate → Audit log → Safe stop → Tested fallback.