crow-pet-policy-gate

name	crow-pet-policy-gate
description	Classify action risk and return Silent, Notify, Ask, or Block decisions before sensitive, external, or state-changing work.

crow.pet Policy Gate

Use this skill when a task can read sensitive context, write files, call tools, publish, spend money, change external systems, generate persistent agents, invoke provider billing, or mutate crow.pet behavior.

Workflow

1. Read the task record and proposed action.
2. Classify the action across decision axes.
3. Read the matching trust state when one exists; an earned tier lowers friction only through the promotion rules in the risk matrix.
4. Apply policy precedence: Block > Ask > Notify > Silent.
5. Return one decision with a short reason.
6. Include the exact approval request and approval receipt fields when the decision is Ask.
7. Stop when the decision is Block.

Decision Axes

Axis	Values
scope	local_read, local_write, repo_write, external_read, external_write
reversibility	reversible, hard_to_reverse, destructive
sensitivity	public, internal, private, secret
auth_surface	none, user_session, scoped_token, admin_token
blast_radius	one_file, repo, account, production
cost	free, metered, purchase
publication	private_draft, shared, public
persistence	ephemeral, session, persistent, personal

Decisions

Decision	Meaning
Silent	Run and summarize later.
Notify	Run and notify before or after.
Ask	Request explicit approval and a matching receipt before proceeding.
Block	Refuse until policy changes or task is reframed.

Progressive Disclosure

Load examples/policy-decisions.md when examples are needed.

Load contract.md and rubric.md only for acceptance or evaluation.

Use ../../templates/approval-receipt.yaml for Ask decisions that permit side effects.

Use ../crow-pet-orchestrator/policies/approval-policy.md and ../crow-pet-orchestrator/policies/risk-matrix.md as the default policy source.

Use ../../templates/trust-state.yaml when reading or proposing earned-tier changes.

Dependency Edges

• loads_context: task record, proposed action, selected adapter, context sensitivity, approval history, and matching approval receipt when present.
• evaluates_with: contract.md, rubric.md.

Rules

• Skills and adapters may raise risk but never lower it below the task or adapter risk.
• Skills and adapters cannot bypass the policy gate.
• Approval receipts are valid only for the exact action, adapter/profile, target, payload digest, data sent, cost cap, auth surface, rollback path, expiration, approver, timestamp, idempotency key, and verification plan they name.
• Target, payload, adapter/profile, data sent, sensitivity, cost, auth surface, rollback, or verification changes invalidate the receipt and require a fresh Ask.
• Billing, publishing, authenticated actions, package installs, deploy actions, remote writes, live Pi/factory calls, provider SDK calls, provider API billing, cloud delegation, and generated persistent agents require Ask plus an approval receipt.
• Secrets exposure is always Block; secret references may appear by name only and never as values.
• Production data and safety-gate changes require Ask or Block.
• Whole-file self-improvement rewrites require Ask.
• The policy gate rules on one action at decision time; the Gatekeeper adjusts which tier an action class has earned over time. Gate decisions stay authoritative.
• destructive and auth-sensitive action classes never gain autonomy.
• Edits to policies, rubrics, the risk matrix, or workflow definitions are Ask-tier. This binds every actor, including the Gatekeeper and any workflow.