Agent access register

Generated 2026-10-21 12:48:52 · 11 agents in the registry · policy: Acceptable-use policy for scheduled agents (Adopted 2026-10-03 by the fleet owner, with edits to the 2026-10-02 draft. Rule AUP-05 (work systems) was considered and dropped, so the numbering skips it.)

Config allows, policy forbids

Declared access: it's in a settings file, a task approval, or the registry. Nothing here is a guess.

Instructions ask for what policy forbids

Inferred from each task's SKILL.md and the scripts it runs. Whether config would let these through isn't known for agents in auto mode, so they're kept apart from the list above.

Shared config: what every agent under it inherits

Allow rules aren't per-agent. Each settings file below applies to every agent listed against it, so its rows aren't repeated in the per-agent table.

Credential stores

Existence and the rules that reach each one. No store is opened.

Every agent

declared is in permission config. inferred was read out of the task's instructions or a script they run; it can be wrong in both directions. Shared rules above apply on top of each row.

Just-in-time pass: what each agent's runs use of what it's granted

observedRead from the transcripts of 173 scheduled runs between 2026-09-22 and 2026-10-21 (a 30-day window). Every tool call is matched to the narrowest standing grant that covers it: a shared allow rule, a per-task approval, or the working directory. A grant every run used is one the agent needs each time. A grant only some runs used could be granted to the run that needs it and dropped when that run ends. Agents with fewer than 3 runs are listed but not sorted.

Shared rules any run used

5 of 17 shared allow rules covered at least one call in the window. The rest covered none. These files also apply to interactive sessions, which this pass doesn't read, so unused here means unused by scheduled runs.

Matcher check. 398 of 406 calls carry Claude Code's own record of what allowed them; for the rest, attribution is this matcher alone. On 310 calls, Claude Code's own record says a standing rule let the call through. The matcher found a current rule of the same kind for 310 of them (100%). For 0 it found a rule of the other kind (a task approval where Claude Code named a settings rule, or the reverse), and for 0 it found none: a rule removed since, or one this matcher reads differently.

Where policy is silent

Access that shows up in config or instructions and that no policy rule speaks to, for or against. Silence isn't approval; each line is a decision nobody has written down.

What this page can't see

• What the auto-mode classifier lets through. 9 agent(s) run in auto, where anything the allowlist doesn't name goes to a classifier this tool can't read. For those agents the allowlist is a floor, not a ceiling.
• Which mode 1 agent(s) with no mode in the registry actually start in.
• What agents did beyond the tool calls in their run transcripts. The just-in-time pass reads those calls; it can't see inside a script a call runs, or any run outside its window.
• Which MCP servers and connectors are attached when a scheduled run starts. Tool names in rules and instructions are read; whether the tool is there at run time is not.
• Managed settings, command-line flags, and plugin or mod permission hooks.
• Whether any control works. A hook that is registered and a rule that is written are both reported as present, and neither has been probed by this tool.
• Scripts past one hop. A script that SKILL.md runs is scanned; anything that script imports or calls is not.
• What a script does at run time. Paths and hosts built from variables don't show up in a text scan.
• Keychain contents, and whether any credential file holds a live secret.
• Operating-system permissions (macOS privacy grants, file modes beyond existence).
• Other machines. Agents scheduled anywhere else aren't in this registry.
• 1 task folder(s) on disk have no row in the registry. They're listed, not analysed: something else may still run them.

The policy this was checked against

Plain rules for agents that run on a schedule with nobody watching. Each one is grouped under the NIST AI RMF function it serves most (Govern, Map, Measure, Manage); the mapping is loose and meant for orientation, not a compliance claim. A rule the register can test says so. A rule it can't test says that instead of pretending.