Codex Guardian treats "Inspect only; do not publish" as an authorization limit.

PR #47811 records explicit user goal updates as authorization evidence and invalidates cached authorization when they change. Objectives too large to retain get dropped whole with evidence marked incomplete, so truncation can't silently convert a restriction into a grant (GitHub). PR #47819 re-reviews a pending action against the latest instructions when new input arrives mid-review instead of aborting. That truncation detail is a good design instinct: failing to a denial, not to a default.