Summary

ToolPermissionChecker currently implements category-level gating only. The spec defines granular sub-constraints per access level (workspace scope, network mode, containerization level, git access mode).

Design Spec Reference

• §11.2 Tool Access Levels — full YAML with per-level sub-constraints
• §11.1.1 note on M3 category-level gating only

Scope

• Per-level sub-constraints: file_system scope, network mode, git access, code_execution isolation level
• Integration with sandbox backends
• custom access level support with per-agent configuration