A permissions worksheet to whitelist tools/actions by default and separate “draft tools” from “ship tools”.