Roles, tiers and rules
Every tool call is decided on the agent before anything runs, by the role of the member who paired it and the workspace's rules. The policy comes from the service signed, and the agent checks the signature before it trusts it.
Tiers. Every target is prod, lower or sandbox. An environment rule names it first: the first rule whose pattern matches a namespace or a database's name wins (staging-* → lower). A name no rule matches takes its connection's tier, from the environment given at connect add:
prod,productionorliveis prod;stage,staging,test,qa,uatorpreprodis lower;dev,development,sandbox,laborlocalis sandbox;- anything else, or none, is prod: the safe end.
Roles. A role grants reading, writing and personal data per tier. Owner may do everything everywhere. Operator reads everywhere, writes below prod, and sees personal data on lower. Reader reads everywhere and changes nothing. A role may also be limited to some connections or namespaces.
Writes. Nothing here writes: every tool reads, through a database role that cannot write.
Draft and publish. In the console's Policy place an Owner edits the roles and rules as a draft. Nothing decides by a draft: the gateway and every agent decide by the version last published, until an Owner publishes the next. Simulator tries a call against both before you publish.
A denial names the role, the tier and why: "Reader cannot act on prod (production-payments matched rule *prod*)". It is a result like any other, and a row in the audit.
strata policy prints the policy this agent decides by.