Propose a business policy. An ordinary agent can never activate a safety gate.

Capability: policies:propose. A DENY or REQUIRE_APPROVAL policy submitted by an ordinary read+write credential is stored as PROPOSED and is NOT enforced; it becomes ACTIVE only after a human workspace owner/admin confirms it in Forbiz, or when the credential holds the delegated policies:manage capability. ADVISORY policies may be created directly. Passing a confirmedBy name is provenance, not authority: it never activates anything.