tool calls, token burn, memory writes, webhooks, PLM mutations

requirement mutations, model releases, ALM ticket updates, workflow state approvals

jobs, worker execution, replayed simulations, promoted results, cloud cost

resources, config mutations, artifacts, egress, public endpoints

fieldbus messages, actuator changes, physical commands, incident truth

capture, fee, settlement, refund, webhook, merchant paid truth

signed URLs, blobs, externalized bytes, access windows, replicas, public paths

active tokens, sessions, keys, role bindings, successful access attempts

Where NO must hold.