Where it fits
Define the transaction boundary before evaluating runtime control.
The decision to make
Define the transaction boundary before evaluating runtime control. A policy can decide whether to begin a task while a later command or tool call needs a separate permission check. Ask which of those points the proposed integration actually controls. Separate the base privileged-access scope from ARC and any gateway or secrets capability whose commercial inclusion has not been confirmed.
What this record does not establish
Vendor claims about universal coverage, zero standing privileges and action-level enforcement are not independent measurements. Verify integration-specific behavior, retained sessions and included modules for the exact proposal.
1 current source · 2 published assertions
Source coverage is a research boundary, not a quality score.