5. Read the plan and apply the risk gate

The corrected validation response in Chapter 4 includes a plan, because Harborview declares plan. The plan is a layer of its own, but it does not need a call of its own: validation and plan arrive together, in one response. Read that plan; do not reconstruct it in client prose. For this two-step flow it aggregates to max_risk: "destructive", driven by the dock unlock.

The catalog already establishes the important policy fact:

The dock entry carries:

{
  "risk_hints": {
    "readOnly": false,
    "destructive": true,
    "openWorld": false
  }
}

The Host therefore pauses before sending run_flow. Approval must come from outside the Model: a person or an existing Host policy.

This division is deliberate:

Model: authors and requests execution
Host: evaluates risk and decides whether to transmit

The plan is still a server claim. Approval UI should say so and should show the program alongside the plan.

See The plan and risk and Part II §7.3.