Control families
Authorizationrole / actor / tenant binding
Policyexplicit business constraints
Evidencerequired support before action
Idempotencyduplicate suppression
Replay defensenonce / command reuse protection
Human reviewdefer when automation should not decide
Auditstructured decision evidence
Recoveryunknown outcome and controlled re-entry
