Permission firewall for delegated work

Before an agent runs, make the blast radius explicit.

Agent Scope Auditor turns a fuzzy delegation request into a copyable permission contract: tools, data classes, review gates, stop conditions, and a risk disposition in under 90 seconds.

Inspired by MCP sprawlagent managersprivacy fingerprinting

Current disposition54Human-in-the-loop

Diff review before push or merge

01 / Define the run

Delegation requestUseful output artifact

Allowed tools

Data classes

Autonomy2/5Review strictness3/5Memory retention2/5

02 / Copy the contract

gateDiff review before push or merge

gateAllow-list commands and timeouts

gateEnd-of-run evidence summary

agent_scope_contract:
  task: "Build and verify one small Next.js Daily App, then push to GitHub only."
  allowed_tools:
    - GitHub repo write: open branches, commits, and PRs only inside named repos
    - Local files: read/write only inside the declared workspace
    - Shell commands: run bounded build/test/status commands
  allowed_data:
    - Private repo code: Allow diffable edits; block secrets.
  autonomy_level: 2/5
  review_level: 3/5
  retention_level: 2/5
  required_gates:
    - Diff review before push or merge
    - Allow-list commands and timeouts
    - End-of-run evidence summary
  expected_output: "Commit SHA, public route, build result, and blocker summary."
  stop_conditions:
    - Needs a secret, credential, private key, payment, trade, or irreversible external action
    - Scope expands beyond the named task or workspace
    - Evidence cannot be produced for a claim
  risk_score: 54
  disposition: Human-in-the-loop