# Agent to Outcome: permissions and approvals

For each tool, record its purpose, approved data, allowed operation, account owner, and enforcement setting.

| Tool or connection | Data scope | Allowed action | Requires approval | Enforced where? | Owner |
|---|---|---|---|---|---|
| | | | | | |

## Before the first connected run

- [ ] Use an approved account and official connection.
- [ ] Grant only the file, app, record and action access required for this task.
- [ ] Keep credentials out of prompts, files and output logs.
- [ ] Distinguish reading from sending, publishing, spending, deleting or changing records.
- [ ] Name the human approver and show the exact payload and destination.
- [ ] Configure the approval gate in the platform or workflow; do not rely only on a prompt.
- [ ] Treat webpages, emails, documents and tool responses as untrusted source data.
- [ ] Set step, retry and spending limits where the platform supports them.
- [ ] Define stop, revoke-access, recovery and rollback procedures.
- [ ] Confirm what persists, where it is stored, and when it is deleted.

## Before an external action

Show: proposed action; exact content or change; recipient/destination; cost if applicable; source evidence; remaining uncertainty; undo path.

Approve only the intended action. If a result is uncertain, inspect the destination before retrying a write that could create a duplicate.

## Operating owner

Owner: ______
Access review date: ______
Stop/pause control: ______
Incident contact: ______

These are teaching prompts. Set actual permissions and controls in your chosen platform.