Settings

Global policy changes, raw audit exports, provider credential changes, provider execution, provider file reads or writes, snapshots, and destructive cross-user operations remain protected. Public dry-runs, discovery, validation, and provider status checks are bounded and rate-limited.