Tool Permissioning Tiers

About this workflow

Classify tools by risk and enforce tiered permissions: auto-allow, session-allow, always-ask, and never - enforced in the harness.

What happens when you run it

1. 1
   Reversibility and blast radius decide the tier.

   Runs flow-tool-permissioning-tiers-1-classify-the-toolset-by-risk on Claude Sonnet 4.6
2. 2
   One chokepoint, impossible to bypass.

   Runs flow-tool-permissioning-tiers-2-enforce-tiers-in-dispatch on Claude Sonnet 4.6
3. 3
   Convenience with an expiry date.

   Runs flow-tool-permissioning-tiers-3-implement-session-grants-and-revocation on Claude Sonnet 4.6
4. 4
   Auditability plus a live-fire test.

   Runs flow-tool-permissioning-tiers-4-log-decisions-and-drill-the-system on Claude Sonnet 4.6

Best for

• •Recurring tasks you currently copy-paste between tools.
• •When a single prompt isn't enough — you need a chain where output(n) feeds prompt(n+1).
• •Fork and adapt if your inputs differ materially from the author's use case.

Models used