ai-worker only needs security audit commands, not deployment access. Removed: - nh os switch - nixos-rebuild switch Kept: - Firewall checks (iptables) - Fail2ban status - Log inspection (journalctl) - SSH config (sshd -T) - Docker service checks - Network diagnostics