Control Rooms are role-gated operational surfaces. Every protected action requires scope keys and emits receipts. If policy/receipt sinks are missing, the system fails closed.