{
  "artifact": "tool-permission-review",
  "fields": ["tool", "scope", "credentialOwner", "sensitiveActions", "approvalRequired", "auditEvidence", "rateLimit", "rollbackPath", "revocationPath"],
  "decision": ["approve", "approveWithControls", "pilotOnly", "reject"],
  "gate": "No write-capable AI tool enters production without approval, logging, rollback, and revocation evidence."
}