A ceiling per agent that no earned trust overrides, approval requirements per action class, and hard platform rules underneath: confirmation before sending, everything logged, everything undoable where undo is honest.
The owner's limit is absolute: an agent capped at drafting drafts forever. Class rules stack on top, so irreversible actions wait for humans regardless of the agent's record.
And the floor is non-negotiable: receipts on acts, permissions on facts, no surveillance, ever.