The policy gate exists in the CommandExecutor (Policy(command, state) → { allowed, reason }), but there's no defined default policy or configuration model.
Define what happens automatically vs. what requires human confirmation:
- Planner runs: auto-allowed (read-only analysis, low cost)
- Implementor runs for trivial/low complexity: auto-allowed
- Implementor runs for medium/high complexity: require TUI confirmation
- Reviewer runs: auto-allowed (read-only)
- All agent dispatch: blocked when global concurrent run limit exceeded
The policy should be configurable (config file, not hardcoded) so operators can adjust thresholds. The policy function signature already supports this — this issue is about defining the
default rules and the configuration shape.
