Approve the exact payload. Execute it separately.

Every outbound connector command is normalized and hashed before review. Approval is valid only for that digest, and execution produces append-only evidence without retaining raw provider responses.