Hosts can interpose a confirm UI between an agent dispatch and the
side effect via set_confirm_handler. Agents request
bounded SUDO via request_authority(scope, ttl_ms);
every subsequent confirm_action in that scope (or
lower) resolves without re-prompting until the TTL expires. Higher
scope grants satisfy lower-scope checks (high > medium > low).