Four places where an agent should propose, not commit

The pattern is the same everywhere: the agent reads with read-only access and emits a change set, policy decides what auto-merges, a named human clears the rest, and a separate merge worker holds the only write credential. What changes is which fields are expensive to get wrong.

Same review layer, whichever record you are protecting.