a solving agent cannot infer risk from a final screenshot it needs the known start state, ordered actions, expected and actual results, permission boundaries, a passing control, and verified readback. humans still own impact and the acceptable final state