# Library Context

### Job this is for

Review agent authority before granting or changing access to tools, browser sessions, repositories, memory paths, retrieval sources, or privileged identities.

### When to use it

- an agent reads untrusted content before acting
- a connector, MCP server, browser profile, or workflow needs scoped permissions
- a human browser session or broad token may be reused by an agent
- a prompt, Skill, retrieval path, tool, or memory path changes capability
- GitHub issues, pull requests, comments, or workflow files become agent input

### Inputs needed

- agent purpose and owner
- context sources and trust levels
- allowed reads, writes, and external actions
- identity source and credential class
- previous and proposed capability set
- tool output that may influence planning or action

### Expected output

- context quarantine map
- permission card
- service identity recommendation
- capability diff
- tool-result influence boundary
- browser profile isolation review
- GitHub input trust review

### What good looks like

- untrusted content cannot rewrite privileged instructions
- permissions are scoped to the job and expire when the job ends
- browser sessions and credentials are isolated from personal accounts
- capability diffs are reviewed before deployment
- GitHub and tool outputs are treated as data, not instructions

### Operating steps

1. List every context source the agent can read.
2. Mark which sources are trusted instructions and which are untrusted data.
3. Map required reads, required writes, and external actions.
4. Assign a service identity or browser profile that limits blast radius.
5. Compare previous and proposed capabilities before changing access.
6. Define how tool output may influence memory, planning, tool selection, and action.
7. Route permission expansion, identity reuse, or untrusted-input exposure to security review.

### Operator run sheet

| Step | Owner          | Action                                            | Required input                                            | Data class   | Approved tool path         | Approval gate                    | System of record     | Done when                          |
| ---- | -------------- | ------------------------------------------------- | --------------------------------------------------------- | ------------ | -------------------------- | -------------------------------- | -------------------- | ---------------------------------- |
| 1    | Platform Owner | Map context and permissions                       | context sources, tools, reads, writes                     | internal     | approved platform registry | owner review                     | permission registry  | permission card is complete        |
| 2    | Security       | Review identity and quarantine boundaries         | identity source, browser profile, untrusted content       | confidential | security review workspace  | security before access expansion | access review record | boundaries are approved or blocked |
| 3    | Workflow Owner | Confirm capability diff and tool-output influence | old capability set, new capability set, tool output paths | internal     | review channel             | required before release          | change log           | release decision is recorded       |

This run sheet is the part a manager can operationalize. If the team cannot identify authority owner, identity source, approval gate, and system of record, the workflow is not ready for agent access.