Agent Review

Audit a candidate agent against the five-gate contract plus mandatory Gate 6 (Tool Allowlist Minimality). Agents are sub-process roles with their own tool capabilities — each tool granted is an attack/error surface, so the allowlist gate is mandatory for this type.

When to Use

Three fire contexts:

1. Author self-audit — dogfood your own draft before committing. Invoked from agent-creator Phase 7.
2. External candidate adoption — gate before pulling a Mall agent or store agent into this brain.
3. Periodic re-audit — re-check existing agents on a cadence (e.g., quarterly retraining).

The shared gate model lives in skill-review/SKILL.md § The Five Gates. This file documents the agent-specific criteria for each gate plus the mandatory Gate 6 — Tool Allowlist Minimality.

A mechanical validator (e.g., a brain-qa script that ships with the heir) typically checks Gate 1 frontmatter compliance and the mechanical subset of Gate 5. Gates 2–6 are judgment-only.

The Five Gates + Gate 6

A candidate must pass all six to ship. Failure on any gate = decline or revise.

Gate 1 — Spec Compliance

Gate 2 — Content Quality

Gate 3 — Scope Fit

Gate 4 — Safety

Same criteria as skill-review § Gate 4. Agent-specific note: Gate 4 and Gate 6 overlap on tool safety — Gate 4 covers destructive-default avoidance in the prose; Gate 6 covers the allowlist.

Gate 5 — Currency & Coherence

Same criteria as skill-review § Gate 5. Agent-specific note: if the agent references skills/prompts it delegates work to, those references must resolve to live artifacts (semantic Gate 5).

Gate 6 — Tool Allowlist Minimality

Mandatory for all agents. Each tool the agent can call is an attack surface (prompt-injection risk) and an error surface (misuse risk).

Decision Matrix

Recording the Verdict

For self-audits and routine re-audits: the verdict lives in the commit message or the conversation. No separate file.

For external adoption (Mall agent, store agent) or any decline that sets precedent: write a verdict capturing gate results, rationale, required changes (if Revise), and the act-pass trail. Agent audits always record the Gate 6 tool-allowlist analysis in the verdict, even on Accept. Store wherever your heir keeps audit decisions.

Anti-Patterns

Falsifiability

This skill's agent-specific criteria have failed if any of the following occur within 90 days:

• An accepted agent is reported as exceeding its scope or tool allowlist by 2+ heirs (criteria miscalibrated)
• Gate 6 declines cluster on a single tool class (e.g., always rejecting run_in_terminal) and are reversed during re-audit (allowlist criterion too strict)
• An agent passes Gate 3 (distinct role) but later is identified as redundant with another agent ≥2 times in a quarter (dedup criterion too lax)
• A security incident (prompt injection, tool misuse) ships through an Accepted agent (Gate 6 criteria failed to prevent)

Track as you would any falsified discipline (commit log, retraining notes, or curation ledger if your repo ships one) tagged [AGENT-REVIEW-MISS].

Related

• skill-review — sibling for skills; canonical source of the shared five-gate contract
• agent-creator — inverts these gates into authoring phases
• instruction-review — sibling for instructions
• prompt-review — sibling for prompts
• system-prompt-skepticism — load-bearing for Gate 2 agent behavior
• act-pass — required for medium-stakes audits
• /review-agent prompt — slash-command entry point