From 12e0c03eec13ac9c3cbfd3d99a4f2f6102a2d9be Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 28 Jul 2026 13:33:17 +0000
Subject: [PATCH] =?UTF-8?q?fix(skills):=20drop=20the=20per-skill=20`permis?=
 =?UTF-8?q?sions`=20keys=20=E2=80=94=20the=20field=20does=20not=20exist=20?=
 =?UTF-8?q?in=20SkillSchema=20(objectstack#3820)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All six skills declared `permissions: ['crm:…']`. SkillSchema has no such
field, so Zod strips the key at parse time: it granted and restricted
nothing while reading as a security control — the ADR-0049 prohibited
shape, flagged in objectstack#3820 §4. Access to AI capability is gated at
the agent level (`agent.access`/`agent.permissions`, enforced at the chat
route) and by each tool's own authz; the spec now documents this on
SkillSchema itself (objectstack#3871).

typecheck, `objectstack validate`, and the test suite (67) all pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BHjroNkLkajskKbJaidko4
---
 src/skills/case-triage.skill.ts         | 2 --
 src/skills/customer-360.skill.ts        | 2 --
 src/skills/email-drafting.skill.ts      | 2 --
 src/skills/lead-qualification.skill.ts  | 2 --
 src/skills/live-data.skill.ts           | 2 --
 src/skills/revenue-forecasting.skill.ts | 2 --
 6 files changed, 12 deletions(-)

diff --git a/src/skills/case-triage.skill.ts b/src/skills/case-triage.skill.ts
index 157dc3cc..8e45c605 100644
--- a/src/skills/case-triage.skill.ts
+++ b/src/skills/case-triage.skill.ts
@@ -27,6 +27,4 @@ classify a case:
   triggerConditions: [
     { field: 'objectName', operator: 'eq', value: 'crm_case' },
   ],
-
-  permissions: ['crm:case:write'],
 });
diff --git a/src/skills/customer-360.skill.ts b/src/skills/customer-360.skill.ts
index 61b9a29c..4a442226 100644
--- a/src/skills/customer-360.skill.ts
+++ b/src/skills/customer-360.skill.ts
@@ -24,6 +24,4 @@ customer / account / contact:
     'give me the full picture',
     'account summary',
   ],
-
-  permissions: ['crm:account:read'],
 });
diff --git a/src/skills/email-drafting.skill.ts b/src/skills/email-drafting.skill.ts
index 898139e3..5bd59f64 100644
--- a/src/skills/email-drafting.skill.ts
+++ b/src/skills/email-drafting.skill.ts
@@ -25,6 +25,4 @@ export const EmailDraftingSkill = defineSkill({
     'optimise subject line',
     'email template',
   ],
-
-  permissions: ['crm:email:write'],
 });
diff --git a/src/skills/lead-qualification.skill.ts b/src/skills/lead-qualification.skill.ts
index 80d1430d..b0ef65d8 100644
--- a/src/skills/lead-qualification.skill.ts
+++ b/src/skills/lead-qualification.skill.ts
@@ -36,6 +36,4 @@ export const LeadQualificationSkill = defineSkill({
   triggerConditions: [
     { field: 'objectName', operator: 'eq', value: 'crm_lead' },
   ],
-
-  permissions: ['crm:lead:read'],
 });
diff --git a/src/skills/live-data.skill.ts b/src/skills/live-data.skill.ts
index 94e9f8f0..f9a289f7 100644
--- a/src/skills/live-data.skill.ts
+++ b/src/skills/live-data.skill.ts
@@ -52,6 +52,4 @@ record (account, contact, lead, opportunity, case, quote, etc.):
     'pipeline',
     'forecast',
   ],
-
-  permissions: ['crm:read'],
 });
diff --git a/src/skills/revenue-forecasting.skill.ts b/src/skills/revenue-forecasting.skill.ts
index d449729d..dbd54fb1 100644
--- a/src/skills/revenue-forecasting.skill.ts
+++ b/src/skills/revenue-forecasting.skill.ts
@@ -30,6 +30,4 @@ risk, or deal slippage:
   triggerConditions: [
     { field: 'objectName', operator: 'in', value: ['crm_opportunity', 'dashboard'] },
   ],
-
-  permissions: ['crm:opportunity:read'],
 });