A practice-first plan for tool approval gates for AI agents · PitHub