Skip to content

Policy — Resource Access

Guide

Policy — Resource Access

HR documentation · binding on every employee. Complements Security & Secrets (security.md) and the Access Request SOP (docs/sop/SOP-001-access-request.md).

Principle: every employee is a top expert and must have the resources they need, at all times — balanced against least privilege. Agents hold standing access to what their role requires; anything beyond that is requested and approved.

Resource classes

  • Knowledge — the canon, docs, the knowledge base (docs/knowledge/), and domain references. Standing access: all employees (read).
  • Tools — Claude Code / MCP tools, declared per agent in tools: frontmatter. Standing access: the minimum the role needs (GR-4); more by request.
  • Process / pipeline — hooks, CI. Standing access: Operations.
  • Integrations / MCP, secrets, outward-facing services — external systems and credentials. Never standing by default; granted by the Principal on request.

Rules

  • Request when you lack it. Don’t work around a missing resource — file an access request (docs/sop/SOP-001-access-request.md); the request is the GR-4 needs analysis.
  • Least privilege. Hold only what the role needs; prefer time-boxed for sensitive access.
  • No secrets in the repo (security.md). Personal information is PA-only (confidentiality.md).
  • Grants are auditable — every grant is recorded in hr/access/requests.md and reflected in the agent’s tools: / settings.