# Actions and output access

The runtime owns tools, execution and enforcement. Stageframe can send only a known permitted approval resolution through a separately configured signed return channel. Transport acceptance does not establish execution completion; a later runtime event confirms the result. Public demo and read-only client viewers cannot issue decisions.

Artifact metadata and content access are separate permissions. Output retrieval checks workspace authority and current client selection. Reviewed UTF-8 text content is resolved only from operator-selected files within a configured root and verified against its approved SHA256 digest. Changed or missing content fails closed. Provider paths and arbitrary object URLs are never browser download links.

The public demo uses an expiring reviewed same-run selection with a dedicated reader credential. Only reviewed display labels, event times, reported state and permitted text output leave this projection. Raw event payloads and private resource identifiers are withheld.