Re-evaluate access controls when read-only workflows start writing
A control safely deferred during a read-only phase becomes a prerequisite when the workflow starts persisting sensitive manifests, paths, approvals, targets, or mutation state. Before that transition, verify live row policies and grants, harden server-only access first when broad…