Chain-touching and destructive actions execute only after quorum. Every decision is signed in your browser with a non-extractable key; requesters cannot self-approve and requests expire after 72h.