diff --git a/config.lua b/config.lua
index a1fb895..9c5370a 100644
--- a/config.lua
+++ b/config.lua
@@ -92,4 +92,35 @@ return {
     --     -- a status and breaks; default 8 if absent.
     --     max_tool_depth = 8,
     -- },
+
+    -- Phase 3 (docs/PHASE3.md): Chuck Norris autonomous mode + destructive-op
+    -- heuristic. The block is OFF by default (sane defaults kick in when
+    -- absent); uncomment to tune.
+    --
+    -- safety = {
+    --     -- LLM second-opinion on commands the static patterns don't flag.
+    --     -- Default true. Set false for static-only operation (faster, but
+    --     -- misses novel destructive patterns the static list doesn't know
+    --     -- about — bash -c content, custom destructive idioms, etc.).
+    --     llm_second_opinion = true,
+    --
+    --     -- Which configured model to use for the YES/NO destructive probe.
+    --     -- Precedence: this field → models.deep → models[default_model].
+    --     -- R-B2: prefer an INDEPENDENT model class from the action-emitting
+    --     -- model (avoids self-policing). Recommended values:
+    --     --   "cloud"  — anthropic/claude-haiku-4.5 via openrouter. Fast and
+    --     --              reliable. Costs money per probe (typical Norris
+    --     --              session = 16 probes max, often cached).
+    --     --   "deep"   — local large model (qwen3-30b on this fleet). Free
+    --     --              but slow on RK3588 hardware (~1-3s per probe).
+    --     --              Falls back here automatically if not set.
+    --     --   "fast"   — same model as the action-emitter. NOT RECOMMENDED
+    --     --              (circular trust); use only when no other option.
+    --     llm_model = "cloud",
+    --
+    --     -- Norris planning-loop budget. Iterations of safety.norris_step.
+    --     -- Each iteration is one broker round-trip + dispatch of actions.
+    --     -- Default 8. Bump for long-running goals; cap low for testing.
+    --     max_norris_steps = 8,
+    -- },
 }