Rivumi permission layering: how dangerous commands become allow, ask, or deny
Rivumi applies a non-bypassable critical floor, evaluates user, organization, and project denies before any allows, and keeps execute operations policy-gated even in dangerous mode. This decides authority; it is not an OS sandbox.