Local Execution and Security
Workspace actions require a clear boundary.
Paymod Code has its own device authorization and local execution model. Do not assume its device session grants access to a financial Agent Wallet. Command and diff approval behavior follows the current extension implementation.