Not yet reviewed. Artifacts stay locked until you approve them.
Step 5 of 9
Tool and action policy
What an agent may do on your behalf, and what it must ask about first.
Instruction files cannot enforce this — the host does. What they can do is state the expectation clearly enough that a violation is obvious.
This is a stated expectation, not enforcement. An instruction file cannot stop an agent doing any of these things — the host that runs the tools decides that. What this matrix produces is a policy an agent can be held to and a reviewer can check a transcript against.
All 12 actions are at their safe defaults.
Read
3 actionsRead repository and files
Reading changes nothing. An agent that must ask to look cannot work.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
No extra requirements.
Recorded against this row in your draft. No compile path emits it yet.
Search documentation and the web
Checking a current source beats answering from memory.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
No extra requirements.
Recorded against this row in your draft. No compile path emits it yet.
Inspect metadata
Package, schema, and config metadata are read-only facts.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
No extra requirements.
Recorded against this row in your draft. No compile path emits it yet.
Draft
1 actionCreate drafts
A draft nobody has accepted has no effect. Gating it only slows review.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
No extra requirements.
Recorded against this row in your draft. No compile path emits it yet.
Internal change
3 actionsModify local files
Recoverable through version control, but still a change you did not type.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
No extra requirements.
Recorded against this row in your draft. No compile path emits it yet.
Create a branch or pull request
Visible to collaborators the moment it exists.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
No extra requirements.
Recorded against this row in your draft. No compile path emits it yet.
Run a database migration
Schema changes are frequently irreversible in practice, whatever the down script says.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
- Migration and rollback both stated before running
Recorded against this row in your draft. No compile path emits it yet.
External action
5 actionsSend an external message
A sent message cannot be recalled, and it speaks in your name.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
- Recipient and full message shown first
Recorded against this row in your draft. No compile path emits it yet.
Submit an external form
The receiving system may act on it immediately and may not offer an undo.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
- Summary of every field being submitted
Recorded against this row in your draft. No compile path emits it yet.
Deploy to production
Users see the result before you do.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
- Rollback plan stated before deploying
Recorded against this row in your draft. No compile path emits it yet.
Delete data
The one action where a wrong guess cannot be walked back.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
- Named target
- Stated blast radius
Recorded against this row in your draft. No compile path emits it yet.
Purchase or move money
Reversing a payment is a dispute, not an undo.
Authorization
What the agent must do before taking this action.
Requirements
Conditions that must accompany the confirmation.
- Amount and counterparty stated
Recorded against this row in your draft. No compile path emits it yet.
Tool contracts
The matrix above covers actions in general. A contract covers one tool: what it reads, what it drafts, what it changes inside your boundary, and what it changes where another party can see it.
A contract is a stated expectation, not enforcement. An instruction file cannot stop an agent calling a tool, and nothing here reaches the tool itself — the host that runs it decides what happens. What a contract gives you is a written expectation a reviewer can check a transcript against.
Captured, not yet compiled. Every contract you author here is stored on your draft. Nothing in this build turns it into a rule or an export, so it does not reach an agent yet — it is collected now so the answer is not lost when the export step lands.
No contracts yet. A new one starts with no external mutations, confirmation required on everything, and an audit log expected.