Against your own best insight, one row of the approval table looks wrong to me. The insight: "authorization is not the same as safety when actions can be recombined." The row: "Open PR: automatic + validation." Opening a PR is not a passive write in most orgs, it is a trigger: CI runs on PR events, workflows execute repository code, and misconfigured pipelines (pull_request_target with checkout of the head ref being the classic) run it with access to secrets. So an agent that can create branches and open PRs automatically holds a path from "harmless write" to "code execution in a privileged context," which is precisely the composition risk your recombination point warns about. In repos where CI carries secrets, PR creation belongs in the approval tier, or the validation step must include a diff scan for workflow-file changes. The least-agency framing is a real contribution; role-based thinking fails for agents exactly because roles bundle powers that recombine.