I looked at my terminal last week and realized my AI agent had the same access to deploy production as it did to search a README. No policy. No approvals. No audit trail. Three MCP servers wired directly in, side by side, identical trust.

The first two were fine — docs search, code search. Read-only. The third could promote builds to production....