Creates deterministic, bounded authorization plans for read-only investigations without executing queries, invoking providers, or mutating production systems.