Zelta flips it: Propose the action → score the risk → get human approval → bind it to a one-time token → only then execute.
No more guessing what your agent actually did.