Change gates and approval contract

Purpose

Prevent accidental or autonomous changes that can affect availability, safety, security, data, or developer workflows.

Operation classes

Class A: read-only by default

Allowed without approval:

• List databases, branches, keyspaces, webhooks, backups, roles, traffic budgets, schema recommendations, deploy requests, and Insights data.
• Inspect repository code.
• Read schema metadata.
• Read non-sensitive database metadata.
• Produce reports and proposed change sets.

Class B: state-creating proposals