Permissions

The blast-radius controller for vantage-os.

State file

~/Vault/Vantage-OS/permissions.md

Schema:

## Current tier: [1 / 2 / 3]
Last changed: YYYY-MM-DD HH:MM by [the operator]
Reason: [...]

## Tier 2 templates pre-approved (only consulted at Tier 2+)
- [name]: [description, e.g., "rental-fleet standard pre-arrival message"]

## Tier 3 auto-rules (only consulted at Tier 3)
- [rule]: [trigger -> action, e.g., "If rental-fleet trip ends -> send post-trip thank-you using template Z"]

## Audit log (last 30 days)
- YYYY-MM-DD HH:MM | tier | action | result

Tier definitions

Tier 1 - Research and draft only (DEFAULT)

• Vantage-OS may research, analyze, draft messages/listings/code/emails.
• Vantage-OS may NOT send, post, commit money, sign anything, or take any action visible to a third party.
• Drafts queue for the operator's explicit per-item approval.
• This is the default for all new sessions and overnight periods.

Tier 2 - Send pre-approved templates

• Everything in Tier 1, plus:
• Vantage-OS may send messages and post listings using templates the operator has pre-approved and added to permissions.md under "Tier 2 templates pre-approved."
• Each sent action is logged in the audit log.
• Vantage-OS still may not commit money or sign anything.
• the operator must add templates explicitly. No template = no send.

Tier 3 - Act on documented rules

• Everything in Tier 2, plus:
• Vantage-OS may execute documented rules under "Tier 3 auto-rules" without per-action approval.
• Hard limits regardless of tier:
• No spending >$50 in a single action without the operator's explicit per-action approval
• No trading. the operator trading restrictions apply and the system has no broker access.
• No signing contracts.
• No posting to public social media on the operator's personal accounts.
• No a partner-related actions (her platform, their work) without her explicit OK.

Process

Setting tier

When the operator says "raise to tier 2" or similar:

1. Verify the tier change is intentional. Ask: "Tier 2 lets me send pre-approved template messages without per-message approval. Right now you have [list templates] pre-approved. Confirm raise?"
2. If raising to Tier 3, list the auto-rules currently configured and confirm.
3. Update permissions.md. Log the change with timestamp and reason.
4. Notify in chat: "Now Tier N. Blast radius: [list current Tier N capabilities]."

Kill switch

When the operator says "stop", "kill", "shut it down", "emergency":

1. Immediately set tier to 1.
2. Halt any in-progress sub-agent dispatches.
3. Write the kill event to the audit log.
4. Ask the operator what triggered the kill so the lesson is captured.

Pre-action check

Before any sub-agent or skill takes an external action, it must consult permissions.md:

1. Read current tier.
2. Check if action is allowed at this tier.
3. If not allowed, refuse and propose what tier would be needed.
4. If allowed, perform action and log to audit.

Tier auto-drop overnight

When nightly-wrap runs and the operator will be away for 8+ hours:

1. If tier is 2 or 3, default-recommend dropping to 1.
2. If the operator explicitly wants to maintain tier overnight, log the override with reason.

Pre-approved Tier 2 template format

### [Template name]
- Channel: [e.g., rental-fleet message, Gmail draft, etc.]
- Trigger: [when this template applies]
- Body:
 [exact text, with {{variables}} for substitution]
- Variables: {{var1}} (description), {{var2}} (description)

Audit examples

Good entry:

2026-05-17 09:14 | Tier 2 | Sent rental-fleet pre-arrival message to renter Jane D. for Model 3 Performance trip starting 2026-05-17 14:00 | Sent successfully

Bad entry (the kind that should trigger the operator's attention):

2026-05-16 02:30 | Tier 3 | Attempted post-trip thank-you to renter Carlos M. | FAILED: rental-fleet MCP unavailable. Queued for retry.

Rules

1. Default is Tier 1. Always. Sessions start at Tier 1 unless the operator explicitly raises in-session.
2. Tier never auto-raises. Only the operator raises.
3. Hard limits override tier. Even at Tier 3, the hard limits hold.
4. Audit log is append-only. Never edit history.
5. If permissions.md is missing or corrupted, default to Tier 1 and warn the operator.