# Risk tiers The policy model is built on risk tiering: the higher a tool's potential for harm, the more controls apply. | Tier | Example tools | Default behaviour | | --- | --- | --- | | Read-only | `lookup_order`, `get_customer` | ALLOW free. The egress scan still runs. | | Write | `issue_refund`, `update_record` | Allowed but **argument-constrained**: threshold, regex, enum. | | External effect / irreversible | `send_email`, money movement, deletion | ESCALATE human approval; or `allow: false`. | | Unlisted | — | BLOCK (`unlisted_tools: deny`). | ## Policy design principles 1. **Close first, then open.** Start from an empty policy and add the tools the agent's job needs one by one. 2. **Derive thresholds from business rules.** Like "refunds over 500 need approval". 3. **Put approval on externally-effecting tools** and leave `egress_scan` on. 4. **Measure with shadow.** Run a new policy in shadow before going live to see what it would block.