access-levels
Skill2 starsChanged 25 days agoMITView on GitHub
Sets how much the agent may do on its own across five levels (read only, sandbox edits, ask first, safe auto-run, production), starts at the lowest level that can do the job, and moves up one level only when the owner says so. Fixes "I gave the agent full access on day one, and it changed things I never agreed to." Use when you start working with a new agent or a new project, before you let it edit, run commands or deploy, when you are about to turn off permission prompts, and whenever it touches something that ships to users. Also on /access-levels.
In this repository102 other files it gives its agents.
- agent-failuresSkill
- agent-guardSkill
- agent-hooksSkill
- agent-limitsSkill
- agent-loopSkill
- agent-patternsSkill
- agent-wikiSkill
- ai-in-businessSkill
- answer-checksSkill
- ask-firstSkill
- automate-questionsSkill
- batch-judgeSkill
- big-archiveSkill
- brief-partsSkill
- bug-triageSkill
- build-an-evalSkill
- calls-to-keepSkill
- checkpointsSkill
- check-waysSkill
- claude-md-rulesSkill
- code-mapSkill
- command-guardSkill
- compact-safelySkill
- context-rulesSkill
- corrected-twiceSkill
- count-checkSkill
- data-leaksSkill
- day-gateSkill
- disprove-findingsSkill
- dogfood-firstSkill
- done-testSkill
- draft-only-mailSkill
- drift-checkSkill
- fail-closedSkill
- failed-readsSkill
- faster-sameSkill
- first-messageSkill
- fix-reviewSkill
- handoff-noteSkill
- handoff-rulesSkill
- hard-problemsSkill
- harness-starterSkill
- hidden-text-checkSkill
- hooks-to-addSkill
- injection-guardsSkill
- inventory-firstSkill
- keys-and-agentsSkill
- live-checkSkill
- lock-on-failureSkill
- long-videosSkill
- mcp-partsSkill
- memory-queueSkill
- memory-sourcesSkill
- memory-trimSkill
- night-alarmSkill
- objectorSkill
- old-code-judgeSkill
- one-task-gateSkill
- past-green-testsSkill
- phone-rulesSkill
- The first 60 shown.
The file
We split this skill into the rules it gives an agent
7 rules. About 0 are common, 7 are distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈7
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 11
Start at the lowest level that can do the job.
- Distinctive: line 14
Every release is signed off by a person, at every level.
- Distinctive: line 17
Write the task in one sentence and what it needs to touch: files, commands, the live product.
- Distinctive: line 20
Ask first: Every command waits for you.
- Distinctive: line 23
Write the current level and the reason in CLAUDE.md.
- Distinctive: line 26
If you are not sure which level a task needs, use the lower one.
- Distinctive: line 29
No level lets the agent deploy, publish or release without a person's yes.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Access levels
The agent got full access on day one and changed things nobody agreed to. That happens because nothing earned the access first. This skill gives the agent access in five levels, so it gets more as it earns your trust.
The principles
- Start at the lowest level that can do the job.
- Move up one level at a time, and only on the owner's word.
- A mistake moves the agent down a level, not just the output back.
- Every release is signed off by a person, at every level.
Steps
- Write the task in one sentence and what it needs to touch: files, commands, the live product. Pick the lowest level that covers it, say which level and why, and ask "Start at this level?"
- Read only. The agent looks and suggests. It makes no edits. Use plan mode (Shift+Tab) so it can read files but cannot change them, and it ends with a written suggestion.
- Sandbox edits. Changes stay in a safe copy. Make a new git branch or worktree (
git worktree add ../sandbox -b sandbox) and let the agent edit only there. Main stays clean. You read the diff before anything merges. - Ask first. Every command waits for you. Keep the normal permission mode, so each edit and each command stops and asks for your yes. Never answer "yes, and don't ask again" for a command you have not read.
- Safe auto-run. Safe ones run on their own, and the rest ask. Write a short list in
.claude/settings.json: commands that only read or test (run the tests, the linter,git status,git diff) go under allow. Push, delete and deploy go under ask. Show the list and start only after a yes. - Production. A person signs every release. The agent prepares it: the version number, the notes and the check results. Deploy and publish commands go under deny. The release comes to you, and you ship it or say no.
- Write the current level and the reason in CLAUDE.md. Move up only when the owner says so. After a mistake, move down one level and note what went wrong.
Rules
- If you are not sure which level a task needs, use the lower one.
- A command that is not on the allow list asks. It never runs on its own.
- The agent never raises its own level or edits its own permission list.
- No level lets the agent deploy, publish or release without a person's yes.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.