ADR 0007 — Default never + workspace-write

Status

Accepted

Context

Recorded from the architecture seed list.

Decision

Autonomy does not require danger-full-access; widen with --add-folder.

Consequences

Documented in the architecture roadmap; CI enforces the load-bearing ones.