awoooi/docs/evaluations/ai_agent_operation_permission_model_2026-06-12.json

{
  "schema_version": "ai_agent_operation_permission_model_v1",
  "generated_at": "2026-06-12T15:40:00+08:00",
  "program_status": {
    "overall_completion_percent": 97,
    "current_priority": "P2",
    "current_task_id": "P2-101",
    "next_task_id": "P2-102",
    "read_only_mode": true,
    "runtime_authority": "operation_permission_model_only_no_live_execution_or_send",
    "status_note": "P2-101 把 P2-404 shadow/無寫入 candidate 轉成操作類別權限模型；目前只定義 observe、無寫入 replay、proposal、人工批准與明確阻擋 lane，不啟動 live worker、不寫 Gateway queue、不送 Telegram、不寫 production target。"
  },
  "source_refs": [
    "docs/evaluations/ai_agent_runtime_worker_shadow_gate_2026-06-12.json",
    "docs/evaluations/ai_agent_report_runtime_fixture_readback_2026-06-12.json",
    "docs/evaluations/ai_agent_report_runtime_dry_run_2026-06-12.json",
    "docs/ai/AI_AGENT_AUTOMATION_WORKLIST_2026-06-04.md",
    "docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md"
  ],
  "operation_permission_truth": {
    "permission_model_ready": true,
    "operation_category_matrix_ready": true,
    "risk_tier_mapping_ready": true,
    "agent_responsibility_mapping_ready": true,
    "approval_gate_mapping_ready": true,
    "manual_sop_lane_ready": true,
    "p2_404_shadow_gate_handoff_ready": true,
    "runtime_execution_enabled": false,
    "gateway_queue_write_enabled": false,
    "telegram_send_enabled": false,
    "telegram_bot_api_call_enabled": false,
    "delivery_receipt_write_enabled": false,
    "ai_runtime_worker_enabled": false,
    "medium_low_auto_worker_enabled": false,
    "post_action_verifier_live_readback_enabled": false,
    "production_write_enabled": false,
    "secret_value_read_enabled": false,
    "paid_provider_call_enabled": false,
    "host_or_cluster_command_enabled": false,
    "destructive_operation_enabled": false,
    "work_window_transcript_display_allowed": false,
    "runtime_execution_count_24h": 0,
    "gateway_queue_write_count_24h": 0,
    "telegram_send_count_24h": 0,
    "telegram_bot_api_call_count_24h": 0,
    "delivery_receipt_write_count_24h": 0,
    "ai_runtime_worker_run_count_24h": 0,
    "medium_low_auto_execution_count_24h": 0,
    "post_action_verifier_live_readback_count_24h": 0,
    "production_write_count_24h": 0,
    "secret_value_read_count_24h": 0,
    "paid_provider_call_count_24h": 0,
    "host_or_cluster_command_count_24h": 0,
    "destructive_operation_count_24h": 0,
    "truth_note": "P2-101 只建立操作類別與權限 lane；所有實際執行、queue write、Telegram send、Bot API、receipt write、worker、verifier live readback、production write、secret / paid provider access 與 destructive action 仍保持 0。"
  },
  "permission_lanes": [
    {
      "lane_id": "observe_only",
      "display_name": "只讀觀察",
      "summary": "可自動讀取 committed snapshot、已允許的 redacted API、健康摘要與證據鏈；不得寫入或觸發外部副作用。",
      "allowed_outputs": ["證據摘要", "狀態分類", "治理頁顯示"],
      "required_gate_before_promotion": "P2-102 dry-run evidence gate",
      "live_execution_allowed": false,
      "production_write_allowed": false
    },
    {
      "lane_id": "no_write_replay_allowed",
      "display_name": "無寫入 replay",
      "summary": "可重放 fixture / shadow artifact 並產生 diff、hash、verifier input；不得寫 Gateway queue 或正式資料。",
      "allowed_outputs": ["redacted diff", "evidence hash", "queue candidate preview"],
      "required_gate_before_promotion": "P2-102 dry-run evidence gate + verifier binding",
      "live_execution_allowed": false,
      "production_write_allowed": false
    },
    {
      "lane_id": "proposal_only",
      "display_name": "提案 / SOP",
      "summary": "可產生人工可審核的處置建議、Runbook 草案、rollback 計畫與操作選項；不得自行套用。",
      "allowed_outputs": ["人工 SOP", "修復候選", "rollback 草案"],
      "required_gate_before_promotion": "owner review + P2-102 dry-run evidence",
      "live_execution_allowed": false,
      "production_write_allowed": false
    },
    {
      "lane_id": "human_approval_required",
      "display_name": "人工批准後才可推進",
      "summary": "涉及 queue write、Telegram 實發、verifier live readback、低中風險自動化與任何可能影響外部狀態的操作，必須先人工批准並有 verifier / rollback。",
      "allowed_outputs": ["批准包", "dry-run hash", "verifier plan"],
      "required_gate_before_promotion": "explicit owner approval + rollback owner + post-action verifier",
      "live_execution_allowed": false,
      "production_write_allowed": false
    },
    {
      "lane_id": "explicitly_blocked",
      "display_name": "明確阻擋",
      "summary": "secret 明文、付費 provider 擴量、破壞性主機 / 叢集操作與 production config / data write 在本階段全部阻擋，只能降級成提案或證據收集。",
      "allowed_outputs": ["阻擋原因", "降級提案", "缺口清單"],
      "required_gate_before_promotion": "另行維護窗口、費用 / 依賴 / 資安批准",
      "live_execution_allowed": false,
      "production_write_allowed": false
    }
  ],
  "operation_categories": [
    {
      "category_id": "observe_inventory_read",
      "display_name": "只讀盤點 / 狀態讀取",
      "risk_tier": "low",
      "permission_lane": "observe_only",
      "primary_agent": "hermes",
      "allowed_outputs": ["狀態摘要", "freshness 判讀", "缺口清單"],
      "blocked_actions": ["production write", "secret value read"],
      "required_evidence": ["source ref", "generated_at", "redacted fields"],
      "next_gate": "P2-102 dry-run evidence gate",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:1111111111111111111111111111111111111111111111111111111111111111"
    },
    {
      "category_id": "diagnose_correlate_evidence",
      "display_name": "診斷 / 證據關聯",
      "risk_tier": "low",
      "permission_lane": "observe_only",
      "primary_agent": "openclaw",
      "allowed_outputs": ["嚴重度判讀", "MCP evidence 摘要", "manual next step"],
      "blocked_actions": ["repair execution", "queue write"],
      "required_evidence": ["MCP evidence ref", "incident ref", "correlation reason"],
      "next_gate": "P2-102 dry-run evidence gate",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:2222222222222222222222222222222222222222222222222222222222222222"
    },
    {
      "category_id": "report_digest_queue_candidate",
      "display_name": "報表 / 戰情室 queue candidate",
      "risk_tier": "medium",
      "permission_lane": "no_write_replay_allowed",
      "primary_agent": "hermes",
      "allowed_outputs": ["queue candidate diff", "digest preview", "readback checklist"],
      "blocked_actions": ["Gateway queue write", "Telegram sendMessage"],
      "required_evidence": ["redacted digest hash", "recipient route ref", "zero-signal classification"],
      "next_gate": "gateway_queue_write_permission_gate",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333"
    },
    {
      "category_id": "shadow_no_write_replay",
      "display_name": "shadow / 無寫入 replay",
      "risk_tier": "medium",
      "permission_lane": "no_write_replay_allowed",
      "primary_agent": "nemotron",
      "allowed_outputs": ["promotion hash", "verifier fixture", "side-effect report"],
      "blocked_actions": ["live worker", "result write"],
      "required_evidence": ["fixture id", "replay hash", "side-effect count"],
      "next_gate": "P2-102 dry-run evidence gate",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
    },
    {
      "category_id": "manual_sop_draft",
      "display_name": "人工 SOP / 操作選項草案",
      "risk_tier": "medium",
      "permission_lane": "proposal_only",
      "primary_agent": "hermes",
      "allowed_outputs": ["人工步驟", "驗證步驟", "rollback 說明"],
      "blocked_actions": ["自動執行", "host command"],
      "required_evidence": ["owner role", "affected scope", "rollback owner"],
      "next_gate": "owner review",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
    },
    {
      "category_id": "repair_candidate_proposal",
      "display_name": "修復候選提案",
      "risk_tier": "medium",
      "permission_lane": "proposal_only",
      "primary_agent": "openclaw",
      "allowed_outputs": ["修復候選", "風險理由", "dry-run 要求"],
      "blocked_actions": ["Ansible apply", "kubectl apply", "service restart"],
      "required_evidence": ["MCP evidence", "PlayBook trust", "verifier plan"],
      "next_gate": "P2-102 dry-run evidence gate",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:6666666666666666666666666666666666666666666666666666666666666666"
    },
    {
      "category_id": "low_risk_noop_execution",
      "display_name": "低風險 no-op 自動處理",
      "risk_tier": "medium",
      "permission_lane": "human_approval_required",
      "primary_agent": "openclaw",
      "allowed_outputs": ["批准包", "no-op plan", "post-action verifier plan"],
      "blocked_actions": ["live worker execution"],
      "required_evidence": ["explicit approval", "dry-run hash", "replay hash"],
      "next_gate": "medium_low_auto_worker_permission_gate",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:7777777777777777777777777777777777777777777777777777777777777777"
    },
    {
      "category_id": "medium_risk_repair_execution",
      "display_name": "中風險修復執行",
      "risk_tier": "high",
      "permission_lane": "human_approval_required",
      "primary_agent": "openclaw",
      "allowed_outputs": ["批准包", "rollback plan", "維護窗口建議"],
      "blocked_actions": ["repair apply", "restart", "config reload"],
      "required_evidence": ["owner approval", "rollback owner", "verifier live gate"],
      "next_gate": "production_write_permission_gate",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
    },
    {
      "category_id": "post_action_verifier_live_readback",
      "display_name": "post-action verifier live readback",
      "risk_tier": "high",
      "permission_lane": "human_approval_required",
      "primary_agent": "nemotron",
      "allowed_outputs": ["verifier plan", "expected signal", "failure lane"],
      "blocked_actions": ["canonical target readback", "result write"],
      "required_evidence": ["allow-list", "redacted output", "failure receipt plan"],
      "next_gate": "post_action_verifier_live_gate",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:9999999999999999999999999999999999999999999999999999999999999999"
    },
    {
      "category_id": "telegram_gateway_queue_write",
      "display_name": "Telegram Gateway queue write / 實發",
      "risk_tier": "high",
      "permission_lane": "human_approval_required",
      "primary_agent": "hermes",
      "allowed_outputs": ["route approval packet", "queue candidate", "delivery verifier plan"],
      "blocked_actions": ["Gateway queue write", "Bot API sendMessage"],
      "required_evidence": ["SRE route ref", "dedupe key", "delivery receipt plan"],
      "next_gate": "telegram_send_permission_gate",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
    },
    {
      "category_id": "production_config_or_data_write",
      "display_name": "production config / data write",
      "risk_tier": "critical",
      "permission_lane": "explicitly_blocked",
      "primary_agent": "openclaw",
      "allowed_outputs": ["blocked reason", "owner approval requirements", "dry-run requirement"],
      "blocked_actions": ["DB write", "ConfigMap apply", "Nginx reload", "workflow mutation"],
      "required_evidence": ["source-of-truth", "rollback ref", "maintenance window"],
      "next_gate": "production_write_permission_gate",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
    },
    {
      "category_id": "secret_or_paid_provider_access",
      "display_name": "secret value / paid provider access",
      "risk_tier": "critical",
      "permission_lane": "explicitly_blocked",
      "primary_agent": "nemotron",
      "allowed_outputs": ["metadata-only checklist", "cost approval packet", "secret name parity"],
      "blocked_actions": ["secret value read", "paid API call", "token hash collection"],
      "required_evidence": ["費用批准", "redaction policy", "owner response"],
      "next_gate": "secret_or_paid_provider_gate",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
    },
    {
      "category_id": "destructive_host_or_cluster_action",
      "display_name": "破壞性主機 / 叢集操作",
      "risk_tier": "critical",
      "permission_lane": "explicitly_blocked",
      "primary_agent": "openclaw",
      "allowed_outputs": ["break-glass checklist", "rollback owner request", "maintenance window request"],
      "blocked_actions": ["ssh write", "sudo", "restart", "reboot", "delete", "active scan"],
      "required_evidence": ["維護窗口", "rollback owner", "post-check plan"],
      "next_gate": "另行資安 / 維護窗口批准",
      "queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "secret_value_read_allowed": false,
      "destructive_action_allowed": false,
      "live_execution_allowed": false,
      "evidence_hash": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
    }
  ],
  "agent_permission_roles": [
    {
      "agent_id": "openclaw",
      "display_name": "OpenClaw",
      "permission_responsibility": "負責 operation category、risk tier、approval lane 與 repair candidate arbitration；可產生提案，不可自我批准或執行。",
      "allowed_lanes": ["observe_only", "proposal_only", "human_approval_required"],
      "blocked_now": ["self approval", "production write", "host command", "Telegram direct send"],
      "self_approval_allowed": false,
      "live_action_count_24h": 0
    },
    {
      "agent_id": "hermes",
      "display_name": "Hermes",
      "permission_responsibility": "負責 KM / Runbook / 報表 / SRE 戰情室 queue candidate 的整理與草案；不得寫 Gateway queue 或發 Telegram。",
      "allowed_lanes": ["observe_only", "no_write_replay_allowed", "proposal_only"],
      "blocked_now": ["Gateway queue write", "Telegram send", "production data write"],
      "self_approval_allowed": false,
      "live_action_count_24h": 0
    },
    {
      "agent_id": "nemotron",
      "display_name": "NemoTron",
      "permission_responsibility": "負責 無寫入 replay、verifier fixture、redaction / cost / secret boundary review；不得呼叫付費 provider 或讀 secret。",
      "allowed_lanes": ["observe_only", "no_write_replay_allowed", "proposal_only"],
      "blocked_now": ["paid provider call", "secret value read", "live verifier execution"],
      "self_approval_allowed": false,
      "live_action_count_24h": 0
    }
  ],
  "gate_transitions": [
    {
      "gate_id": "p2_101_permission_review_gate",
      "display_name": "P2-101 permission review gate",
      "current_status": "ready_for_review",
      "required_before": "所有 P2-404 shadow candidate promotion",
      "next_safe_step": "以本模型審查每個 candidate 的 lane 與風險，不啟動 worker。",
      "opens_live_execution": false
    },
    {
      "gate_id": "p2_102_dry_run_evidence_gate",
      "display_name": "P2-102 dry-run evidence gate",
      "current_status": "blocked_until_evidence",
      "required_before": "任何可被批准的低 / 中風險 candidate",
      "next_safe_step": "每個候選操作都要有 dry-run evidence、hash、side-effect count 與 verifier plan。",
      "opens_live_execution": false
    },
    {
      "gate_id": "gateway_queue_write_permission_gate",
      "display_name": "Gateway queue write permission gate",
      "current_status": "blocked_until_evidence",
      "required_before": "任何 Gateway queue write",
      "next_safe_step": "先完成 route、dedupe、receipt、failure lane 與人工批准。",
      "opens_live_execution": false
    },
    {
      "gate_id": "telegram_send_permission_gate",
      "display_name": "Telegram send permission gate",
      "current_status": "blocked_until_evidence",
      "required_before": "任何 Bot API sendMessage",
      "next_safe_step": "先走 Gateway queue + receipt E2E，不允許 direct Bot API。",
      "opens_live_execution": false
    },
    {
      "gate_id": "medium_low_auto_worker_permission_gate",
      "display_name": "中低風險 auto worker permission gate",
      "current_status": "blocked_until_evidence",
      "required_before": "任何 low / medium risk 自動處理",
      "next_safe_step": "需要 operation lane、dry-run、rollback/no-op evidence、post-action verifier 與人工批准。",
      "opens_live_execution": false
    },
    {
      "gate_id": "post_action_verifier_live_gate",
      "display_name": "post-action verifier live gate",
      "current_status": "blocked_until_evidence",
      "required_before": "任何 verifier live readback",
      "next_safe_step": "先定義 input/output allow-list、redaction、failure receipt 與 result write boundary。",
      "opens_live_execution": false
    },
    {
      "gate_id": "production_write_permission_gate",
      "display_name": "production write permission gate",
      "current_status": "blocked_by_policy",
      "required_before": "任何 production config / data write",
      "next_safe_step": "另行 owner approval、maintenance window、rollback owner、dry-run、verifier plan。",
      "opens_live_execution": false
    },
    {
      "gate_id": "secret_or_paid_provider_gate",
      "display_name": "secret / paid provider gate",
      "current_status": "blocked_by_policy",
      "required_before": "任何 secret 明文、付費 provider 呼叫或費用增加",
      "next_safe_step": "只允許 metadata / secret name / cost approval packet；不得讀 value 或增加呼叫頻率。",
      "opens_live_execution": false
    }
  ],
  "operator_decision_templates": [
    {
      "template_id": "evidence_collect_next_step",
      "display_name": "收集證據",
      "when_to_use": "分類、監控、MCP evidence 不足或 provider fresh 但未匹配時。",
      "human_instruction": "查看來源、補 MCP evidence、確認 incident / run / source refs 是否串上。",
      "creates_runtime_action": false,
      "requires_human_review": true
    },
    {
      "template_id": "manual_sop_next_step",
      "display_name": "產生人工 SOP",
      "when_to_use": "AI 選擇不執行修復，或 action candidate 缺少 rollback / verifier。",
      "human_instruction": "依 SOP 檢查服務、log、回滾點與驗證項，完成後回填 outcome。",
      "creates_runtime_action": false,
      "requires_human_review": true
    },
    {
      "template_id": "repair_proposal_next_step",
      "display_name": "修復提案",
      "when_to_use": "OpenClaw 有中低風險候選，但尚未有 dry-run hash 或 verifier plan。",
      "human_instruction": "審查 MCP evidence、PlayBook trust、dry-run、rollback owner 與 blast radius。",
      "creates_runtime_action": false,
      "requires_human_review": true
    },
    {
      "template_id": "queue_candidate_next_step",
      "display_name": "戰情室 queue 候選",
      "when_to_use": "日週月報、action-required digest 或 failure digest 需要進 SRE 戰情室但尚未准許實發。",
      "human_instruction": "確認 route、dedupe、receipt、降噪與內容 redaction，再決定是否進下一 gate。",
      "creates_runtime_action": false,
      "requires_human_review": true
    },
    {
      "template_id": "rollback_or_fix_next_step",
      "display_name": "人工修復 / 回滾",
      "when_to_use": "處置失敗、verifier degraded、或高風險需要人工處理。",
      "human_instruction": "依 rollback owner 與維護窗口處理；禁止由 AI 自行啟動 host / cluster / production write。",
      "creates_runtime_action": false,
      "requires_human_review": true
    }
  ],
  "display_redaction_contract": {
    "redaction_required": true,
    "raw_prompt_display_allowed": false,
    "private_reasoning_display_allowed": false,
    "secret_value_display_allowed": false,
    "raw_telegram_payload_display_allowed": false,
    "work_window_transcript_display_allowed": false,
    "allowed_display_fields": [
      "category_id",
      "display_name",
      "risk_tier",
      "permission_lane",
      "primary_agent",
      "allowed_outputs",
      "blocked_actions",
      "required_evidence",
      "next_gate",
      "evidence_hash"
    ],
    "blocked_display_fields": [
      "raw_prompt",
      "chain_of_thought",
      "telegram_chat_id",
      "telegram_message_id",
      "bot_token",
      "authorization_header",
      "secret_value",
      "work_window_transcript"
    ]
  },
  "rollups": {
    "permission_lane_count": 5,
    "operation_category_count": 13,
    "observe_only_category_count": 2,
    "no_write_replay_allowed_category_count": 2,
    "proposal_only_category_count": 2,
    "human_approval_required_category_count": 4,
    "explicitly_blocked_category_count": 3,
    "human_approval_required_category_ids": [
      "low_risk_noop_execution",
      "medium_risk_repair_execution",
      "post_action_verifier_live_readback",
      "telegram_gateway_queue_write"
    ],
    "explicitly_blocked_category_ids": [
      "destructive_host_or_cluster_action",
      "production_config_or_data_write",
      "secret_or_paid_provider_access"
    ],
    "agent_role_count": 3,
    "gate_transition_count": 8,
    "operator_decision_template_count": 5,
    "runtime_execution_count": 0,
    "gateway_queue_write_count": 0,
    "telegram_send_count": 0,
    "telegram_bot_api_call_count": 0,
    "delivery_receipt_write_count": 0,
    "ai_runtime_worker_run_count": 0,
    "medium_low_auto_execution_count": 0,
    "post_action_verifier_live_readback_count": 0,
    "production_write_count": 0,
    "secret_value_read_count": 0,
    "paid_provider_call_count": 0,
    "host_or_cluster_command_count": 0,
    "destructive_operation_count": 0
  }
}