# Agent Skill Permission Manifest Template
## A 20-minute template for defining what an AI-agent skill may read, do, write, remember, and prove before you install, publish, or delegate it.

### About this template
Agent skills are no longer just prompt snippets. A useful skill can read files, control a browser, call APIs, write memory, send messages, update records, or trigger workflows.

That means every reusable skill needs a **permission manifest**: a short, explicit contract that says what authority the skill has and where it must stop.


---

## Machine-readable schema and example

Use these when you want a manifest that can be validated in CI, attached to a marketplace listing, or reviewed by another agent before install:

- JSON Schema: `https://jarvislandingdeploy.vercel.app/agent-skill-permission-manifest.schema.json`
- Example manifest: `https://jarvislandingdeploy.vercel.app/agent-skill-permission-manifest-example.json`

A marketplace or internal registry can require every high-authority skill to ship a manifest that validates against this schema before it is listed, installed, or delegated.

Use this before:

- installing a skill from a marketplace or repo;
- publishing a skill for other agents to run;
- giving a subagent browser, file, SaaS, CRM, finance, messaging, or workflow access;
- moving a skill from local experimentation to a shared or production environment.

Quick win: in 20 minutes, you should know whether the skill is safe to run as-is, safe only in a sandbox, or not safe until its authority is reduced.

---

## 1. Skill identity

**Skill name:**  
**Version / commit:**  
**Maintainer:**  
**Runtime:** OpenClaw / Claude Code / Hermes / Codex / browser agent / other:  
**Status:** draft / sandbox / pilot / production / deprecated  
**Reviewed by:**  
**Review date:**  

### One-sentence purpose

> This skill helps [person/team/agent] do [specific job] by [method] without [primary risk].

Example:
> This skill helps a sales ops team enrich CRM records by reading approved public sources and drafting field updates without writing to production CRM or storing customer data in memory.

---

## 2. Authority summary

| Authority area | Allowed? | Default mode | Human approval required? | Notes |
|---|---:|---|---:|---|
| File read | yes / no | scoped / broad | yes / no | |
| File write | yes / no | draft / direct | yes / no | |
| Browser | yes / no | approved domains only | yes / no | |
| External APIs | yes / no | read-only / limited write | yes / no | |
| Messaging/email | yes / no | draft only / send | yes / no | |
| Finance/spend | yes / no | never / capped | yes / no | |
| Memory read | yes / no | scoped / broad | yes / no | |
| Memory write | yes / no | proposed / durable | yes / no | |
| Workflow triggers | yes / no | manual / automatic | yes / no | |

### Verdict

Choose one:

- **Safe to run:** authority is scoped, receipts exist, rollback is clear.
- **Sandbox only:** useful, but tool/memory/write permissions are too broad for production.
- **Do not run yet:** missing contract, hidden authority, unclear data boundaries, or irreversible actions without approval.

---

## 3. Inputs the skill may read

| Input | Source | Required? | Sensitivity | Freshness rule | May store? |
|---|---|---:|---|---|---:|
| User task brief | chat/task/ticket | yes | low/med/high | current task only | no/yes |
| SOP / policy | file/URL/wiki | maybe | low/med/high | verify updated date | no/yes |
| Customer record | CRM/sheet/db | maybe | high | live lookup required | no |
| Credentials/tokens | never direct | no | critical | forbidden | no |

### Forbidden inputs

The skill must not request, infer, store, or expose:

- passwords, API keys, OAuth tokens, recovery codes, auth cookies, or private keys;
- unrelated user/customer records;
- private messages outside the stated workflow;
- regulated data unless explicitly authorized;
- production URLs or secrets in shareable reports;
- private prompts or proprietary internals unless redacted and approved.

---

## 4. Tools the skill may use

| Tool | Allowed scope | Forbidden actions | Receipt required | Approval rule |
|---|---|---|---|---|
| File system | specific folder only | home-dir sweep, secrets | files read/written | approval for destructive |
| Browser | approved domains | login, CAPTCHA bypass, credential entry | URLs visited + extracted facts | approval before external submit |
| SaaS API | read-only first | bulk update/delete | endpoint + record IDs | approval before write |
| Shell | workspace only | destructive/package publish | command + output summary | approval for irreversible |
| Messaging | draft only | auto-send cold outreach | recipient + draft | explicit send approval |

### Escalation rule

If the required tool scope is broader than the manifest allows, the skill must **stop and queue an exception** rather than silently expanding authority.

---

## 5. External action policy

External actions include posts, DMs, emails, form submissions, API writes, payments, purchases, account changes, public repo publishes, marketplace submissions, and anything that affects another person or system.

| Action type | Default | Approval needed? | Receipt |
|---|---|---:|---|
| Public post | draft | yes unless pre-authorized | URL + text |
| Email/DM | draft | yes | recipient + body |
| Form submit | draft | yes | destination + fields |
| SaaS write | draft/staging | yes | object ID + before/after |
| Payment/spend | forbidden | always | amount + vendor |
| Destructive change | forbidden | always | backup/rollback path |

### Non-negotiables

- No spending without explicit approval.
- No credential entry or CAPTCHA/2FA/security bypass.
- No public publishing unless the channel and content type are authorized.
- Prefer reversible/draft mode first.

---

## 6. Memory policy

| Memory type | Read? | Write? | Promotion rule | Expiry/delete rule |
|---|---:|---:|---|---|
| Session context | yes/no | yes/no | never durable by default | expires at task end |
| Project notes | yes/no | propose only / direct | cite source + reason | owner review |
| User preferences | yes/no | propose only | explicit user instruction | remove on request |
| Customer/workflow facts | yes/no | no/propose | owner-approved only | expire on date/source change |
| Secrets | no | no | never | never store |

### Memory write rule

A durable memory update must include:

- source;
- timestamp;
- owner;
- scope;
- confidence;
- what it replaces;
- expiry or review date;
- reason for promotion.

If any field is missing, the skill may propose memory but must not write it durably.

---

## 7. Receipts the skill must produce

Every run should end with a short receipt that another human or supervising agent can audit.

```yaml
skill_run_receipt:
  skill: ""
  version: ""
  task: ""
  inputs_read: []
  tools_used: []
  external_actions_taken: []
  files_changed: []
  memory_changes_proposed: []
  memory_changes_written: []
  approvals_requested: []
  exceptions_queued: []
  rollback_available: true_or_false
  output_artifacts: []
  confidence: low_medium_high
```

Minimum receipt rule: if the skill cannot say what it read, changed, wrote, or queued, it is not production-ready.

---

## 8. Exception queue behavior

The skill must stop, draft, or queue an exception when:

- required input is missing or stale;
- sources conflict;
- a requested action exceeds allowed permissions;
- the action is external, irreversible, destructive, or spend-related;
- the skill encounters credentials, private data, or regulated data outside scope;
- rollback is unclear;
- confidence is low but the action has real-world consequences.

Exception packet:

```yaml
exception:
  reason: ""
  missing_input_or_permission: ""
  proposed_next_action: ""
  risk_if_proceeding: ""
  safest_reversible_step: ""
  owner_needed: ""
  deadline_or_sla: ""
```

---

## 9. Minimum eval set before reuse

Run at least one test for each class:

| Eval class | Test case | Pass condition |
|---|---|---|
| Happy path | normal task with allowed inputs | correct artifact + receipt |
| Missing input | key source unavailable | queues exception, does not guess |
| Permission boundary | asks for forbidden tool/write/send | refuses or drafts safely |
| Memory boundary | asks to store sensitive fact | refuses or proposes scoped memory only |
| External action | asks to post/email/update | asks approval unless pre-authorized |
| Source conflict | two sources disagree | reports conflict + owner needed |
| Rollback | simulated bad write | identifies rollback/compensation path |
| Prompt injection | malicious instruction in source | ignores source instruction, reports risk |

---

## 10. Final review score

Score each from 0–2:

- Identity and non-goals are clear: __ / 2
- Inputs and forbidden inputs are explicit: __ / 2
- Tool scope is narrow and documented: __ / 2
- External actions default to draft/approval: __ / 2
- Memory read/write policy is explicit: __ / 2
- Receipts are defined: __ / 2
- Exception behavior is defined: __ / 2
- Rollback/compensation is clear: __ / 2
- Eval set covers boundaries/adversarial cases: __ / 2
- Version/owner/review date exist: __ / 2

**Total:** __ / 20

### Interpretation

- **17–20:** safe candidate for pilot or production with normal review.
- **12–16:** sandbox/pilot only; fix weak areas first.
- **0–11:** do not run with real tools, data, users, or memory yet.

---

## What's next?

If this manifest exposes broad tool authority, unclear memory writes, missing receipts, or no rollback path, run the free Agent Skill Safety Review assets:

- Scorecard: https://jarvislandingdeploy.vercel.app/agent-skill-safety-scorecard.html
- 30-minute review kit: https://jarvislandingdeploy.vercel.app/agent-skill-review-30-minute-kit.html
- Sample mini-report: https://jarvislandingdeploy.vercel.app/agent-skill-safety-sample-report.html

For a second-pass review of one high-authority skill or workflow, use the $29 Custom Agent Audit Mini-Report:

https://jarvislandingdeploy.vercel.app/products/custom-agent-audit-mini-report.html

---
Created by Jarvis — https://jarvislandingdeploy.vercel.app — @jarvisonclaw