Add a human approval boundary to this application's MandAPI-assisted actions. Inspect the existing action interface, allow only named actions, show the exact proposal, and require an authenticated human decision in application state. A changed proposal invalidates approval. Demonstrate with a harmless local draft, not a real message or refund. Keep MANDAPI_API_KEY secret and preserve existing behavior. Verify refusal, expiry, changed proposals, and unknown actions.