Agent Permission Ladder — Tool-Permission & Guardrail Framework for AI Agents

Give any AI agent a tool-permission and guardrail model that's enforced by code, not by a line in a system prompt. A portable framework for Claude Code, Cursor, LangChain/LangGraph, custom agent loops, and any MCP-based multi-agent system.

The problem this solves

Most agent stacks hand the model a tool list and a system prompt asking it to be careful. That's a preference the model can forget under context pressure, get talked out of by a crafted input, or deprioritize mid-task — it isn't a control. As agent security matured through 2026, the field converged on one line: permission is infrastructure, not prompt. This kit gives you that infrastructure as five tiers, a manifest format, a tested enforcement hook, an audit trail, and a red-team checklist — without adopting a new runtime.

What this kit does

• Defines a five-tier Permission Ladder (read_only → propose → auto_safe → human_approval → blocked) for classifying every tool call by what it actually does, not what the model says it's doing
• Ships a manifest format (JSON Schema + worked YAML example) for declaring which tools and argument patterns fall into which tier, with default-deny built in
• Includes a tested reference enforcement hook for Claude Code's PreToolUse event — run through a 15-case test suite, including a real rule-ordering bug caught and fixed before shipping — plus a porting guide for LangChain, custom loops, and MCP clients
• Provides escalation templates for human-in-the-loop approval that bind every approval to one exact tool call, with async/expiry handling and a list of the failure modes that quietly turn approval into a bypass
• Defines a structured audit log schema — the record you hand a security review or a customer's compliance team
• Includes a red-team checklist mapped to all ten OWASP Agentic Security Initiative categories, so you test the manifest against an adversarial input instead of trusting it on paper

Built for

• Anyone shipping an agent that calls real tools — file writes, shell commands, API calls, payments, outbound messages, code execution
• Teams that need a defensible, written answer to "what stops this agent from doing something we didn't authorize"
• Agencies productizing agent builds for clients who ask about guardrails, permissions, or MCP security before signing off

What's inside

• permission-ladder-framework.md — the full methodology: five tiers, default-deny, rule ordering, the tool-classification decision tree
• manifest.schema.json + example-manifest.yaml — the permission manifest format and a complete, schema-valid worked example
• audit-log.schema.json — structured schema for every allow/hold/deny decision
• escalation-templates.md — human-in-the-loop approval prompts, sync and async
• owasp-asi-redteam-checklist.md — one concrete test per OWASP ASI Top 10 category
• hooks/pretooluse-permission-gate.py — the tested Claude Code enforcement hook
• hooks/generic-middleware.md — porting guide for LangChain/LangGraph, custom agent loops, and MCP clients

How you get it

Your full kit — every file, every schema, copy-paste ready — is hosted at ukiyoprod.com/pages/agent-permission-ladder. Bookmark it; nothing else to download.

Author

Built by Ukiyo Productions — an original framework developed in response to 2026's shift toward treating agent permissioning as infrastructure rather than prompt instructions. Not affiliated with, and not derived from the source code of, any specific open-source project. Part of a 100+ product marketplace built for founders, operators, and agencies working with AI agents.