A voice that cannot spend money by accident

INGRID talks a great deal — greetings, narration, answers, status. Some speech backends charge per use, and a companion that speaks constantly is exactly the wrong thing to leave pointed at a metered service by default.

• Her ordinary voice is local. Everyday speech runs on the machine, at no cost, with no network round trip. That is the default, not a fallback for when something else fails.
• One policy, asked by everyone. Rather than each speech path deciding for itself whether a paid backend is acceptable, there is now a single policy that every one of them consults. Scattered decisions drift; one decision can actually be reasoned about.
• Paid speech is opt-in and scoped. A backend that can incur cost is used only where it has been explicitly authorised, rather than becoming the default the moment credentials happen to exist.

The general principle is the useful part: whether something can cost money is a property worth tracking explicitly, in the same way as whether it can change your files or needs the network. It shows up again in Forge, where capabilities carry exactly those flags.