Security boundaries

Approved Scripts is designed around a single rule: delegated system-context execution is allowed only for a reviewed, immutable capability snapshot.

Administrators can select the users and result values permitted by a supported capability. They cannot turn the integration into an unrestricted service runner. See the capability model for the execution boundary and the threat matrix for the reviewed risks and test evidence behind each available action.