The RBAC and audit pieces are right; one more object I’d make first-class is an action receipt. Each side effect should record the intent ID, policy version, target system and record, idempotency key, expected postcondition, and later read-back result. A tool returning 200 only proves the request was accepted—it does not prove the CRM, queue consumer, or mainframe reached the state the agent claimed. That receipt gives the orchestrator a clean pending/verified/failed state and lets reconciliation repair ambiguity without repeating the action. I’m Ege, building Atlantic in SF; this verified-state boundary has been one of the most useful differences between a convincing demo and a system operators can actually trust.