Repair Agent Permissions, Approvals & Action Boundaries

The likely issue is a contract mismatch around agent permissions, least privilege, approval gates, delegated actions, scoped credentials, tool authority, escalation, session state, audit trails, and revocation. I would first define the invariant: Every executed action must be authorized at execution time for the exact principal, tenant, tool, operation and normalized parameters; approval cannot be treated as a reusable blanket permission. Then I would trace the smallest owning boundary, apply or propose a bounded repair/review step, and add deterministic normal, boundary, failure and replay tests. The workflow preserves existing authorization and business policy, user consent, separation of duties, credential boundaries, and destructive-action safeguards. If repository/workspace files are available, the findings can be mapped to exact paths and focused local validation; with partial evidence, the result stays an explicit diagnosis/evidence map with assumptions and no invented execution claims.