NI
That's a fair challenge, and I think it points at something real: there's no finite list that closes this off. In the demo, anything unclassified is treated as mutating and gated by default, so a case I never anticipated still errs on the side of not acting. I deliberately kept the rest out of scope, environment/caller guards like yours, per-identity policy, audit logs, to keep the series on the mechanism rather than turning it into a full safety product. Curious where you draw the line in practice: what's the first guard you reach for once it stops being demo-grade and starts being real?