Invisible automation
Standing permissions cover the routine actions. Anything outside them goes to an approval queue, and a digest records what was done.
Inside the standing grant
A routine action
It runs.
Outside it
Anything else
It waits in the approval queue.
Afterwards
A digest of what was done.
What a grant is
Grants are explicit and revocable, so nothing gains permission silently.
Why the digest exists
“It ran while I was away” never means “I do not know what happened.”