Every AI action is on the record

AI actions pass through policy and land in the tamper-evident audit trail alongside everything else. Key points:

• Per-tool authorisation checks each action against policy before it runs, and a call with no matching allow rule is denied.
• Who approved what, and when, is recorded, so an AI-proposed change is as traceable as any other change on the platform.