Allowed tool calls
6
Within the approved scope
Blocked by policy
1
Not errors — denials
Held for approval
1
Restricted actions
6
Never available to an agent
Agent access matrix
Least privilege · deny by default · scoped per environment
| Agent | Max tier | Approved tools | Escalation | Status |
|---|---|---|---|---|
Product Analyst Requirements and feature specifications | read | 3repo.read, docs.read, issues.write | Product lead | idle |
Architecture Agent System design and module boundaries | read | 3repo.read, docs.write, diagram.render | Platform architect | idle |
Frontend Agent React and TypeScript development | development | 4repo.read, repo.branch, tests.run, pr.open | Frontend lead | active |
Backend Agent Nitro API routes and business logic | development | 5repo.read, repo.branch, tests.run, pr.open, staging.deploy | Backend lead | active |
Database Agent PostgreSQL schema, migrations and query performance | development | 4repo.read, schema.lint, explain.plan, migration.draft | Database administrator | approval required |
QA Agent Automated testing and regression checks | testing | 3tests.run, coverage.read, issues.write | QA lead | active |
Security Agent Vulnerability checks and access-control reviews | testing | 3deps.scan, policy.read, secrets.audit | Security auditor | active |
DevOps Agent CI/CD, staging, releases and rollback preparation | operations | 4ci.read, ci.trigger, staging.deploy, release.prepare | Release manager | failed |
Reliability Agent Monitoring, incidents and recovery recommendations | operations | 4metrics.read, logs.read, incidents.write, node.inspect | Infrastructure engineer | active |
Support Agent Customer tickets, feedback and knowledge base | read | 3tickets.read, tickets.draft, kb.read | Support lead | active |
Licensing Agent Subscription status, renewal workflows and billing triage | read | 3licence.read, payments.read, tickets.draft | Billing administrator | paused |
Documentation Agent Technical documentation and release notes | development | 3repo.read, docs.write, pr.open | Documentation owner | idle |
Tool call audit
Agent, task, tool, target, outcome and duration — append-only
| Call | Agent | Tool | Target | Outcome | Duration | When |
|---|---|---|---|---|---|---|
| CALL-90412 | Database Agent | explain.plan | platform.licences | allowed | 640ms | 27 Oct, 09:47 am |
| CALL-90411 | DevOps Agent | staging.deploy | admin@1.9.0-rc2 | allowed | 184.0s | 27 Oct, 09:31 am |
| CALL-90410 | DevOps Agent | release.production | admin@1.9.0 | approval required | 40ms | 27 Oct, 09:20 am |
| CALL-90409 | Support Agent | records.read | app.voter_records | blocked | 18ms | 27 Oct, 09:12 am |
| CALL-90408 | Reliability Agent | node.inspect | worker-01 | allowed | 210ms | 27 Oct, 08:58 am |
| CALL-90407 | QA Agent | tests.run | suite:webhook-idempotency | allowed | 96.0s | 27 Oct, 08:44 am |
| CALL-90406 | Frontend Agent | repo.branch | feat/org-licence-filters | allowed | 1.2s | 27 Oct, 08:30 am |
| CALL-90405 | Licensing Agent | payments.read | platform.payment_transactions | allowed | 88ms | 26 Oct, 05:28 pm |
Tool calls, workflow runs and audit records are append-only. Agent actions are recorded in agent_tool_calls and agent_audit_logs; permission changes also land in admin_audit_logs.
Restricted actions
Authorization + approval, never a default
- Production releases and rollbacks
- Licence blocking, suspension and manual activation
- Payment gateway configuration and refunds
- Secrets, keys and credential rotation
- Destructive database operations and restores
- Role, permission and account-wide security changes
Enforcement
Where policy actually lives
- Tools check a policy table before every call — not a prompt instruction.
- Agents hold no database credential for app-schema business data.
- Cross-organization reads are impossible: no agent tool exposes tenant records.
- Emergency stop pauses all agents and drains running tasks immediately.