Every capability says what it can touch.
Intent access, raw context, network domains, writes, and credentials are explicit before a plugin is trusted.
Default boundary
| Boundary | Default |
|---|---|
| Intent Graph | Deny unless declared |
| Raw conversations | Deny |
| Network | Deny unless domain-declared |
| External writes | Confirm |