I spent a while getting permission levels right. What an agent may read, what it may write, what needs a human. That work was worth doing, and it did not save me here. The gap is simple to state and easy to miss: permission levels answer what may this agent do . They say nothing about what happens when the task itself changes after the agent already has permission . The situation When work is handed to an agent, the handoff carries a task definition, a scope, and the conditi...