specifically, when I talk about authorisation, I want to avoid this: https://johncodes.com/archive/2026/01-28-there-is-no-secure-...

because that's a valid concern I have with automating all the things - when one of those things does something I don't want because someone else managed to slip it a command to do so, or when that thing's data is breached.