Roles, tiers and rules
Every tool call is decided on the agent before anything runs, by the role of the member who paired it and the workspace's rules. The policy comes from the service signed, and the agent checks the signature before it trusts it.
Tiers. Every target is prod, lower or sandbox. An environment rule names it first: the first rule whose pattern matches a namespace or a database's name wins (staging-* → lower). A name no rule matches takes its connection's tier, from the environment given at connect add:
prod,productionorliveis prod;stage,staging,test,qa,uatorpreprodis lower;dev,development,sandbox,laborlocalis sandbox;- anything else, or none, is prod: the safe end.
Roles. A role grants reading, writing and personal data per tier. Owner may do everything everywhere. Operator reads everywhere, writes below prod, and sees personal data on lower. Reader reads everywhere and changes nothing. A role may also be limited to some connections or namespaces.
Approvals. A role's grant on a tier may also say Approval: a write there then waits for a second person, someone else whose role writes on that tier, who approves or declines it in Approvals within 30 minutes. Approvals says more.
Writes. A tool that writes (kube_scale, kube_rollout_restart, kube_rollout_undo, kube_delete_pod, kube_apply, harness_trigger) runs only where the role may write on the target's tier, and always takes a reason, which the audit keeps; on prod the call is refused without one. Acting on a cluster says what each kube tool does; a Harness run's target is each environment it deploys to, and one Harness marks Production is prod unless a rule says otherwise (The command line, Harness).
Draft and publish. In the console's Policy place an Owner edits the roles and rules as a draft. Nothing decides by a draft: the gateway and every agent decide by the version last published, until an Owner publishes the next. Simulator tries a call against both before you publish.
A denial names the role, the tier and why: "Reader cannot act on prod (production-payments matched rule *prod*)". It is a result like any other, and a row in the audit.
slate policy prints the policy this agent decides by.