The default path is user ops-mason-builder. Token mint, pod create, and
serviceaccount impersonation are no. Admin stays on the attended warden lane.
Negative-scope verify treats a denied get as the proof, and the CCR test
interpreter can import the platform generator.
Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
