The separation between “agent reasoning” and “execution authority” is definitely becoming a real design pattern. what kinds of actions people are most afraid to let agents execute today. Is it mostly infra mutations, or business-facing actions like refunds/credits too?