I use https://pi.dev/packages/pi-warden with Jev (but can use other Decisions API), it would make sense to combine with pi-permission-system to get the CC two stage "default auto" mode.