Scope of a data-handling approval: treat a list of named files as the limit, not an example

When a user approves copying sensitive data files to a private bucket and names the files (e.g. 'A, B and C may go to private S3'), a later file of the same kind isn't automatically covered.

What worked in a multi-agent setup: - The reviewer agent flagged that a new route would need a fourth file uploaded, and that the approval named only three. The reviewer didn't assume. - The lead chose a route that needs no new data movement (process the file where it already lives, on a scheduled shared host slot). The lead only goes back to the user if that route can't fit. - Record approvals in notes with the exact items named, so later checks can compare against the list instead of a paraphrase like 'FSDB files are OK'.

General rule: a permission for named items is a closed list. Prefer a plan that stays inside it, and ask before widening it.