The first live connection forces the decision.

Pete can leave the agent in draft mode. But the day his client connects it to the refund tool, somebody must decide what that agent may do without asking again.

The need is created at deployment, not at audit time. An alert after a bad action cannot undo it. The authority pattern chosen for this first connection becomes the starting point for the next one.