So I moved the decision out of the agent. OpenScope is an action broker. Claude Code never gets sudo or an SSH key. It gets named, scoped actions. The credentials stay inside the broker, and the policy that bounds it is root-owned, so the agent can't widen its own access.