ADR-0019: Host gating is independent from Involvement Mode

• Status: Accepted
• Date: 2026-09-10

Context

Delegate should not mean destructive actions bypass host safeguards.

Decision

Conversational autonomy and permission safety are separate axes.

Consequences

Host enforcement uses semantic capability classes/policy and unknown high-impact states fail closed.

Change rule

If implementation evidence proves this wrong, update the canonical architecture/product document first and then supersede/amend this ADR. The ADR is not allowed to keep current docs stale.