Read-Only Is Not a Safety Boundary

Two sentences get said in every meeting where a team wires an AI agent into a cluster: it's read-only, and just use the service account. Both are wrong later.