GitHub / policy boundary

Authorization workspace

Installations establish technical access. Policies decide what Ambient agents may do with it.