The agent proposes. The policy decides. The human authorizes. The Gateway enforces — by re-reading DataHub itself immediately before the mutation and refusing if the world no longer matches what was approved.
The agent has three tools: list, inspect, propose. It has no tool that mutates DataHub.
Every button drives the real domain against a real DataHub instance. Nothing here is simulated.