The Safest First MCP Workflow Is a Draft Queue, Not an Autonomous Agent

Pilot MCP the boring way: agent prepares work, humans approve side effects, and every action leaves an audit trail.