The same five kinds of capability that read and propose facts also bound what can act. Engines serve. Connectors, sensors and actors propose. Views read. Only a policy or a person promotes, and that includes promoting a proposed action into a real one.
Permission is data the caller cannot write. Which staff may approve which actions is a fact in the graph, evaluated by the policy engine, not a setting inside the thing asking. An automation cannot widen its own permissions.
Customer-facing outbound always queues for a human. Drafts are cheap and reversible. A sent message is neither, so the last step before a customer is a person, every time.
Worked example · A schedule change
A customer messages asking to move the appointment to two. Ontonio drafts a reply and proposes a change to the order. Policy says a same-day change needs the owner. Both sit in the queue. The owner taps approve. The reply goes out, the order updates, and both are recorded as events with provenance.
a worked example in generic terms; every operation renames the labels, the shapes do not change