What the runtime controls
The runtime maps identity, routes intent, checks permissions, strips inaccessible fields, selects the execution path, and records provenance.
That is different from a policy document or dashboard that only observes after the fact.