Let agents run real infrastructure, read-only by default
Let agents run real infrastructure, read-only by default.