fix: connect 10 unconnected backend modules to real code paths (context_builder→agent_runner, agent_permissions→agent_runner, agent_tools→agent_runner, data_policy→agent_runner, oversight→agent_runner+migration 0128, transparency→agent_runner, agent_stream→agent_routes SSE endpoint, agent_memory AI-module deleted, decision_guard→engine, require_approval→agent_runner), 11 integration tests passing

app/workflows/engine.py

@@ -142,6 +142,29 @@ class WorkflowEngine:
         """Execute a step using a registered step handler (G step types)."""
         step_type = step.get("type", "action")
 
+        # ── Decision Guard: check if action requires human review (Punkt 9) ──
+        from app.workflows.decision_guard import check_decision_guard
+        step_config = step.get("config", {})
+        action_name = step_config.get("action", step_type)
+        guard_result = await check_decision_guard(
+            db=self.db,
+            tenant_id=self.tenant_id,
+            instance_id=instance.id,
+            step_config=step_config,
+            action=action_name,
+        )
+        if not guard_result["allowed"]:
+            # Guard blocks — pause workflow and create approval request
+            instance.status = "in_progress"
+            instance.resume_reason = "decision_guard"
+            await self.db.flush()
+            return {
+                "status": "waiting_for_approval",
+                "guard": guard_result,
+                "step_index": instance.current_step_index,
+                "message": guard_result.get("reason", "Human review required"),
+            }
+
         try:
             result: StepResult = await handler(
                 self.db,