A permission policy is the contract between your team and your agent. Start with what it can read, then what it can change, then what always needs a person. Write it in plain language first; the config comes second.