Will your agents change production data on their own?

In one sentence

Not by default. Only what is written into the plan. No permission table, no replay log, no human confirm — the project is declined.