Out-of-band approvals

High-risk actions (buy / send / delete / new login) never confirm inside the agent chat.

Channels the guest cannot see:

• Phone push
• Hardware button / YubiKey
• Local tray app

Capability tokens are bound to a connector + action, not a free-form sentence.