Access matrix · 12 of 19 · Tool tiers

What each kind of agent may do, and who really does it

Write access is mostly a pull request, which a human can revert. The few imperative actions are delegated to systems that already audit themselves. The last row is not exposed to any identity, including Clearance itself.

What each kind of agent may do, and who really does it Access matrix of nine tool groups against three agent kinds, task agent, human-delegated agent and service agent, showing allow, allow but reversible in git, propose only, or never, with the delegated backing system for each tool. Task agentin-clusterDelegated agenthuman-drivenService agentalways onDELEGATED TOT0Read: catalog, metrics, logsallowallowallowBackstage MCP, Prometheus, Loki (read)T0Read: ArgoCD app and diffallowallowallowArgoCD API, read-only accountT1Open a PR on an app repoallow · reversibleallow · reversibleallow · reversibleRepo-scoped token, minted per callT1Request a lower envneverallow · reversibleneverCommit to the tenants repo (GitOps)T1Sync or refresh a lower envneverallow · reversibleneverArgoCD role:clearance-lowerT1Re-run a failed pipelineneverallow · reversibleneverTower's delegated re-runT1Start a child runallow · reversibleallow · reversibleallow · reversibleAgentRun claim, narrower than parentT2PR to an upper gitops repopropose onlypropose onlypropose onlyPR only; human merge, CODEOWNERST3Secrets, exec, upper sync, IAMneverneverneverNot exposed to any identityLEGENDAllowAllow, reversible in gitPropose onlyNever

Principle honored

Delegated over interactive. Every write action must state which category it falls in and the exact API it needs, before it is built (Tower write-action policy).

What changes

  • Definitions are YAML in gitops-infra-clearance, reviewed like any change, and schema-validated in CI.
  • For delegated agents the ceiling is the intersection with the human's own Tower permissions.
  • Starting a child run is a claim, and a claim can only narrow: see Agent teams.

Caution

As of the last handoff (2026-09-15), Tower Tier 1 write actions were built but not live-verified. Verify those first: Clearance would be delegating to something not yet proven against a genuinely stuck app.

Hangar · Autopilot