Field-testing against 83 real agents instead of mocks is the part most permission projects skip, and your stat matches what we see from the supply-chain side: "About 18% of MCP server deployments implement any access scoping." For our August 2026 census we aggregated every published security audit of the agent skill ecosystem, and the five auditors disagree on what unsafe means: one fails 697 listings, another fails zero, so a deterministic engine with explainable decisions is filling a real vacuum: skillselion.com/research/agent-skill-security-cen… (disclosure: I run Skillselion). I see the escalation round-trip is slated for v0.2, so a design question for when it lands: will an expired escalation fall under DD-14's timeout-means-deny, or does the agent loop block waiting? That choice changes how teams size their approval rota.