Classify the toolset by risk

Reversibility and blast radius decide the tier.

First time here? Paste the Context Pack first so the AI understands your project - open it from the header above.

Prompt Capsule

Classify every tool. Tiers: SAFE (read-only, no side effects: file reads, searches, listings) - auto-allow; SESSION (mutating but contained and reversible: file edits in the workspace, git commits) - first use asks, approval covers the session; ASK (consequential or hard to reverse: shell commands by default, network calls, package installs) - every use asks unless a narrow rule says otherwise; NEVER (catastrophic or out of scope: credential file access, force-push, bulk deletion) - blocked outright. For parameterized tools, write argument rules: run_command with a read-only known-safe binary (ls, cat, git status) may drop to SAFE; anything matching destructive patterns (rm -rf, DROP TABLE, force flags) escalates to ASK or NEVER. Deliver the classification table with a one-line justification per tier assignment.

Paste into EmergentFull Build: complete implementation prompt with explicit requirements

Quick is short. Full Build is recommended for most steps. Strict forces real logic when the AI keeps faking output.

Actual change check

Expected after this step

A complete tiered classification with parameter rules.

Should NOT happen

An existing feature broke
A button only logs to console
Data disappears after refresh
Errors fail silently with no visible state

This is what should exist before you continue. If reality does not match, do not move on.

Your notes for this step

Track what changed, failed, or needs follow-up. Notes export with the flow.

Pass the Verify Gate to complete this step

Verify before continuing

Do not move on until every check is true. The complete button stays locked until then.

Every tool assigned with justificationParameter rules cover the shellNEVER list includes credential and bulk-destructive patterns

Do not continue if…

! All-or-nothing permissions: either everything asks or nothing does
! Enforcement via prompt instructions the model can rationalize around
! Session grants that never expire and quietly become permanent
! No log, so nobody can answer 'what approved this?' after an incident

If the AI messes this up

Use this when:

- it only made visual forms or placeholder UI
- buttons do nothing or only log to console
- data is not persisted - state disappears on refresh
- something that worked before is now broken

Use this when the AI fakes progress or breaks the feature. It forces a real fix.

Everything landed in ASK, which users will not tolerate. Re-classify with the reversibility test: if git or a file restore undoes it in seconds, SESSION is usually right - reserve ASK for real consequence.