Capability is not permission
“Deploy your app” does not say whether the workflow logs into a cloud account, edits DNS, overwrites configuration, restarts neighboring services, or uploads artifacts. A permission map separates those actions so authorization has a concrete object.
Authorize by outcome
The user authorizes a defined outcome and scope—not unrestricted exploration across every system. High-impact actions require confirmation at execution time and a rollback target.
Verification has boundaries too
Static validation, script testing, live-provider checks, and end-user acceptance are different evidence layers. Public status should state which layer passed and which remains unrun.