diff --git a/docs/steering-activation-path.md b/docs/steering-activation-path.md
index 4564f43..0b9b66b 100644
--- a/docs/steering-activation-path.md
+++ b/docs/steering-activation-path.md
@@ -67,12 +67,12 @@ and documented in:
 ```text
 docs/steering-artifact-receipts.md
 ```
-
 ## Remaining blockers before #34 can close
 
 - optional ML dependencies installed from `requirements-steering.txt`
 - verified GPT-2 Small model artifacts
 - verified SAE artifacts for SAELens release `gpt2-small-res-jb`, SAE id `blocks.6.hook_resid_pre`
+- digest locks for model and SAE artifacts
 - artifact receipt with exact repo, file path, resolved revision, and SHA-256 digest for each model/SAE file
 - storage receipt for the resolved artifact locations
 - policy admission and agent-registry grant records
diff --git a/src/agent_machine/cli.py b/src/agent_machine/cli.py
index e45a246..9cebaaf 100644
--- a/src/agent_machine/cli.py
+++ b/src/agent_machine/cli.py
@@ -269,6 +269,32 @@ def cmd_registry_resolve(args: argparse.Namespace) -> int:
 def resolve_activation_policy_and_grant(args: argparse.Namespace, agentpod: dict[str, Any], policy_fabric: Any, agent_registry: Any) -> tuple[dict[str, Any], dict[str, Any]]:
     policy_json = args.policy_json
     grant_json = args.grant_json
+    resolver_requested = bool(args.policy_file or args.policy_dir or args.policy_id or args.expected_status)
+    if grant_json is None and policy_json is not None and resolver_requested:
+        grant_json = policy_json
+        policy_json = None
+    if grant_json is None:
+        raise AssertionError(
+            "grant JSON is required. Use either `<agentpod> <policy.json> <grant.json>` "
+            "or `<agentpod> <grant.json> --policy-dir <dir>`"
+        )
+    if policy_json is not None:
+        return load_json(policy_json), load_json(grant_json)
+    policies = policy_fabric.load_policy_admissions(files=args.policy_file, directories=args.policy_dir, root=REPO_ROOT)
+    policy = policy_fabric.resolve_policy_admission(
+        policies=policies,
+        agentpod_id=str(agentpod.get("id")),
+        request_type="activation",
+        deployment_receipt_id=args.deployment_receipt_id,
+        agent_machine_id=args.agent_machine_id,
+        provider_id=args.provider_id,
+        policy_id=args.policy_id,
+        expected_status=args.expected_status,
+        allow_missing_stub=not args.no_missing_stub,
+        decided_at=args.decided_at,
+        root=REPO_ROOT,
+    )
+    return policy, load_json(grant_json)
     policy_resolver_requested = bool(args.policy_file or args.policy_dir or args.policy_id or args.expected_status)
     grant_resolver_requested = bool(args.grant_file or args.grant_dir or args.grant_id or args.expected_grant_status)
     if grant_json is None and policy_json is not None and policy_resolver_requested and not grant_resolver_requested:
@@ -295,6 +321,7 @@ def cmd_activate_evaluate(args: argparse.Namespace) -> int:
     policy_fabric = import_renderer(lambda: __import__("agent_machine.policy_fabric", fromlist=["_unused"]))
     agent_registry = import_renderer(lambda: __import__("agent_machine.agent_registry", fromlist=["_unused"]))
     agentpod = load_json(args.agentpod_json)
+    policy, grant = resolve_activation_policy_and_grant(args, agentpod, policy_fabric)
     policy, grant = resolve_activation_policy_and_grant(args, agentpod, policy_fabric, agent_registry)
     storage_receipts = activation.load_storage_receipts(files=args.storage_receipt_file, directories=args.storage_receipt_dir)
     storage_receipt_refs = list(args.storage_receipt_ref or [])
@@ -437,7 +464,7 @@ def build_parser() -> argparse.ArgumentParser:
     activate_evaluate.add_argument("--pretty", action="store_true")
     activate_evaluate.set_defaults(func=cmd_activate_evaluate)
 
-    steer = subcommands.add_parser("steer", help="Inspect or serve local steering endpoint stubs")
+    steer = subcommands.add_parser("steer", help="Inspect or serve local steering endpoints")
     steer_subcommands = steer.add_subparsers(dest="steer_command", required=True)
     steer = subcommands.add_parser("steer", help="Inspect or serve local steering endpoints")
     steer_subcommands = steer.add_subparsers(dest="steer_command", required=True)
@@ -452,10 +479,12 @@ def build_parser() -> argparse.ArgumentParser:
     serve_stub.add_argument("--port", type=int, default=8080)
     serve_stub.add_argument("--status", choices=["not_configured", "noop"], default="not_configured")
     serve_stub.set_defaults(func=cmd_steer_serve_stub)
+
     preflight = steer_subcommands.add_parser("preflight", help="Inspect readiness for a registered steering sourceset")
     preflight.add_argument("--sourceset", required=True)
     preflight.add_argument("--pretty", action="store_true")
     preflight.set_defaults(func=cmd_steer_preflight)
+
     serve = steer_subcommands.add_parser("serve", help="Serve sourceset-aware local /steer endpoint in fail-closed mode")
     serve.add_argument("--sourceset", required=True)
     serve.add_argument("--host", default="127.0.0.1")