diff --git a/Cargo.lock b/Cargo.lock
index d4df3417..0efbc92e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2049,7 +2049,6 @@ dependencies = [
  "serde",
  "serde_json",
  "strum",
- "tracing",
 ]
 
 [[package]]
@@ -4884,6 +4883,7 @@ dependencies = [
  "hive-jobq-metrics",
  "hive-jobq-wire",
  "hive-log",
+ "hive-sh4re",
  "hive-types",
  "hmac 0.13.0",
  "http",
@@ -5014,6 +5014,7 @@ dependencies = [
  "axum",
  "data-encoding",
  "futures-util",
+ "hive-sh4re",
  "reqwest",
  "rustls",
  "serde",
diff --git a/docs/README.md b/docs/README.md
index 95c804ef..da5f2cd2 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -39,7 +39,7 @@ declarations.
 
 ## Trust boundary & security
 
-- **What's the operator/agent trust boundary? What's a capability?** →
+- **What's the operator/agent trust boundary? What's a permission?** →
   [`trust-boundary/boundary.md`](trust-boundary/boundary.md).
 - **Agent trust model, prompt-injection threat model, credential
   isolation?** → [`trust-boundary/security.md`](trust-boundary/security.md).
diff --git a/docs/agent-lifecycle/agent-roster.md b/docs/agent-lifecycle/agent-roster.md
index e337402e..c8e1ec65 100644
--- a/docs/agent-lifecycle/agent-roster.md
+++ b/docs/agent-lifecycle/agent-roster.md
@@ -2,8 +2,8 @@
 
 <!-- vale write-good.Passive = NO -->
 
-Agents are a **flat set**: the capability store scopes which agents can
-manage which others.
+Agents are a **flat set**: the `manage_root_agent` permission scopes
+which agents can manage which others.
 
 <!-- vale write-good.Passive = YES -->
 
@@ -36,13 +36,13 @@ One entry per agent _this hive_ has state/config for, in name order.
 Unlike the swarm roster, it's a derived cache: the reconcile pass below
 rebuilds it from what the hive observes locally (config repos cloned, containers spawned), and it
 answers a narrower question than "does this agent exist": _which of
-this hive's local agents the `ManageRootAgent` capability's bind-mounts
+this hive's local agents the `ManageRootAgent` permission's bind-mounts
 should cover._ `topology::all_agents` is the only reader that matters.
 
 That reader is a permission boundary: the set it returns is what an agent
-holding the `ManageRootAgent` capability gets bind-mounted (each other
+holding the `ManageRootAgent` permission gets bind-mounted (each other
 agent's `state` read-write and `config` read-only; never `harness`). An
-agent holding no capability sees its own dirs and nothing else:
+agent holding no permission sees its own dirs and nothing else:
 `ManageRootAgent` is the only grant that reaches another agent's state
 dir. See
 [`persistence.md`](persistence.md)'s _Cross-agent access to state._
@@ -51,7 +51,7 @@ dir. See
 
 `topology.json` may also be a map of `name → parent | null`; the reader
 accepts that shape and takes its keys as the roster. An empty
-roster costs more than a cosmetic gap: every capability holder loses its
+roster costs more than a cosmetic gap: every permission holder loses its
 mounts until the next reconcile pass writes the array form.
 
 ### Why meta, not per-agent `agent.nix`
@@ -79,7 +79,7 @@ module docs for the exact call chain.
 ## Hard-coded manager behaviour
 
 The **manager (`ruth`)** differs from other agents in naming/bootstrap,
-its socket flavour and its default capability grant; its prompt, tool
+its socket flavour and its default permissions; its prompt, tool
 allow-list and state dirs work as for every other agent. A hive with
 `services.hyperhive.ruthless = true` runs no manager: `hive-c0re` skips
 its root-agent create/start sweep
@@ -107,7 +107,7 @@ apply.
   manage any agent's state dir — config isn't authored there, since a
   real config change is a PR from a clone), plus RO mounts for
   `/applied` (diff against what's deployed) and `/meta` (system-wide
-  deploy log). That grant is the `ManageRootAgent` capability: ruth
+  deploy log). That grant is the `manage_root_agent` permission: ruth
   holds it by default, and any agent holding it gets the same mounts.
   The operator dashboard's `POST /api/meta-update` is the only path
   that writes `flake.lock`.
@@ -118,11 +118,10 @@ apply.
   `hive-agent/src/prompt.rs`'s own module doc). The `role:manager`
   blocks are dead in production, exercised only by a unit test
   (`filter_role_blocks(SAMPLE, "manager")`).
-- **Tool allow-list** — the MCP tools claude sees come from
-  `HIVE_TOOL_GROUPS` alone, the same mechanism for every agent
-  ([`docs/turn-loop/mcp.md`](../turn-loop/mcp.md)). Ruth's wider default
-  surface is a wider default grant (`ToolGroup::MANAGER_DEFAULT`, seeded
-  by `auto_update.rs` whenever its groups aren't already set).
+- **Tool allow-list** — the MCP tools claude sees come from the agent's
+  permissions alone, the same mechanism for every agent
+  ([`docs/turn-loop/mcp.md`](../turn-loop/mcp.md)). Ruth's default
+  permissions add only `manage_root_agent` (`Permission::default_for`).
 - **State dirs** — _not_ special-cased: `HYPERHIVE_STATE_DIR` is
 injected uniformly via `systemd.globalEnvironment` for every
 container including the manager, so all token/state paths resolve
diff --git a/docs/agent-lifecycle/config-changes.md b/docs/agent-lifecycle/config-changes.md
index 0cf83813..03364edc 100644
--- a/docs/agent-lifecycle/config-changes.md
+++ b/docs/agent-lifecycle/config-changes.md
@@ -244,7 +244,7 @@ bind-mounted **read-only** (`hive-c0re/src/lifecycle/host_config.rs`
 calls `bind_child_agent_dirs` for each entry in
 `topology::all_agents()`). it's a copy to *read* another agent's
 current config — not an editing surface. An agent without the
-capability sees no other agent's config at all.
+permission sees no other agent's config at all.
 
 An agent submits a change to another agent's config the same way it
 makes any other change: **clone the target agent's config repo from the
@@ -252,31 +252,29 @@ forge into its own state dir, commit on a branch, open a PR**, and let
 the operator review and merge it. By design, no second, mount-shaped
 path reaches the same file without the review.
 
-Agents holding the `manage_root_agent` capability (granted per agent in
-`capabilities.json`; see `hive-sh4re/src/permissions.rs`) get additional
-host-side bind mounts via `set_nspawn_flags`:
+Agents holding the `manage_root_agent` permission (granted per agent in
+the swarm's `agent-permissions` record; see
+`docs/process/conventions.md#permissions`) get additional host-side bind
+mounts via `set_nspawn_flags`:
 
 - `/var/lib/hyperhive/agents/` → `/agents/` (RW) — **every** agent's
-  proposed repo, not just direct children. The capability means "may
+  proposed repo, not just direct children. The permission means "may
   manage any agent", so the mounted set is every agent.
 - `/var/lib/hyperhive/applied/` → `/applied/` (RO) — every agent's
   authoritative applied repo, including `.git`.
 - `/var/lib/hyperhive/meta/` → `/meta/` (RO) — the swarm-wide
   deploy flake.
 
-An agent without the capability only has its direct children's config
+An agent without the permission only has its direct children's config
 dirs.
 
-⚠️ nspawn bakes bind flags at container start, so granting or
-revoking this capability doesn't change any mount until that agent's
-container is rebuilt/restarted.
+⚠️ nspawn bakes bind flags at container start, so hive-c0re restarts
+an agent, after its current turn, when its `manage_root_agent` changes.
 
-The root agent gets the capability by default, seeded on its autodeploy
-path (`workers::auto_update::ensure_root_agent`) so the recovery mounts
-are there from its first container. That seed only fires while
-`capabilities.json` doesn't exist yet: any grant or revoke through
-the dashboard creates the file, so a revoked root-agent grant stays
-revoked and isn't re-applied on the next hive-c0re restart.
+The root agent holds the permission by default: an agent whose record
+leaves `permissions` unset gets the default, which includes
+`manage_root_agent` for `ruth` and for no other agent. Setting her
+permissions without it revokes it.
 
 Each proposed repo (`/agents/<n>/config/`) is pre-configured
 with `applied` as a git remote pointing at
@@ -351,8 +349,8 @@ updates the root agent itself.
 
 The system prompt (`hive-agent/prompts/system.md`, rendered by
 `hive-agent/src/prompt.rs`) is the **same for every agent**; what
-varies is which MCP tools it surfaces (gated by tool groups and
-capabilities in `agent.nix`). No `role:manager` block renders only
+varies is which MCP tools it surfaces (gated by the agent's permissions,
+which the swarm sets). No `role:manager` block renders only
 for the root agent. The root agent's role-specific
 behaviour comes from its CLAUDE.md / agent-specific instructions, not
 the system prompt template.
diff --git a/docs/agent-lifecycle/persistence.md b/docs/agent-lifecycle/persistence.md
index 1dbc2cb8..06b255b4 100644
--- a/docs/agent-lifecycle/persistence.md
+++ b/docs/agent-lifecycle/persistence.md
@@ -329,14 +329,14 @@ Under `/var/lib/hyperhive/agents/<name>/`:
 
 ### Cross-agent access to state
 
-An agent holding the `ManageRootAgent` capability gets every other
+An agent holding the `manage_root_agent` permission gets every other
 agent's `state` dir bind-mounted **read-write** and its `config` dir
 **read-only** (`bind_child_agent_dirs` in `lifecycle/host_config.rs`).
 The RW on `state` is deliberate, not an oversight: the holder recovers
 other agents, which includes writing into their state (for example
 seeding notes, clearing a stuck sentinel) as well as reading it.
 
-This is the **only** cross-agent mount. An agent holding no capability
+This is the **only** cross-agent mount. An agent without that permission
 sees its own dirs and nothing else.
 
 **`harness` isn't mounted at all.** It holds that agent's own runtime
@@ -364,7 +364,7 @@ mount should be writable when it shouldn't.
 <!-- vale write-good.Passive = YES -->
 
 Isolation still holds by default: a container has its *own* dirs and,
-unless it holds the capability, nothing else.
+unless it holds the permission, nothing else.
 
 Under `/var/lib/hyperhive/applied/<name>/` — the hive-c0re-only
 applied repo. Tracks `flake.nix` (module-only boilerplate; never
@@ -384,17 +384,9 @@ Contents:
   audit trail (one commit per successful deploy or hyperhive bump).
 - `topology.json` — the agent roster (`["alice", "bob", "ruth"]`).
   Written by `topology::reconcile` on every meta sync; read by
-  `topology::all_agents`, which is the set the `ManageRootAgent`
-  capability grants mounts over. The reader also accepts a map-shaped
+  `topology::all_agents`, which is the set the `manage_root_agent`
+  permission grants mounts over. The reader also accepts a map-shaped
   file carrying a `parent` per agent, and keeps its keys.
-- `tool-groups.json` — per-agent MCP tool group grants
-  (`{ "alice": ["messaging", "inbox", "execution"] }`). Written by
-  `tool_groups::set_groups`; injected as `HIVE_TOOL_GROUPS` env
-  var into each agent's container.
-- `capabilities.json` — per-agent capability grants
-  (`{ "ruth": ["manage_root_agent"] }`). Written by
-  `capabilities::set_caps`; injected as `HIVE_CAPABILITIES` env
-  var. Absent agents have no extra capabilities.
 - `swarm-resource-limits.json` — the caps the swarm sets for this
   hive's agents
   (`{ "sock": { "cpu_quota": "400%", "memory_max": "8G" } }`).
@@ -418,6 +410,15 @@ Contents:
 
 The root agent has the meta dir RO-mounted at `/meta/`.
 
+Outside the meta repo, `/var/lib/hyperhive/swarm-agent-permissions.json`
+holds the permissions the swarm grants this hive's agents, as
+`workers::swarm_permissions` last read them from the swarm's
+`agent-permissions` bucket (every 30 seconds): a copy, not the
+record, which `swarmctl agent permissions` sets. `set_nspawn_flags`
+reads it at every container start for `manage_root_agent`. Each agent gets
+its own entry from it as `swarm-permissions.json` in its runtime dir, which
+it holds until its own first read of its key succeeds.
+
 hive-c0re renders containers onto `meta#<n>` at creation.
 
 ## Destroy vs purge
diff --git a/docs/process/conventions.md b/docs/process/conventions.md
index de91633f..5fa052b6 100644
--- a/docs/process/conventions.md
+++ b/docs/process/conventions.md
@@ -176,7 +176,7 @@ it directly as a bulleted list, no follow-up fetch needed.
 `GetLooseEnds` takes no target — it always returns the caller's own
 rows, on both the agent and manager sockets alike (the manager, `ruth`,
 is a normal agent here, just deployed automatically with different
-default capabilities). `Reminder` rows always carry `owner == self`.
+default permissions). `Reminder` rows always carry `owner == self`.
 
 Per-variant fields:
 
@@ -272,97 +272,83 @@ JetStream permission refusal, a TLS chain failure) rather than a summary.
 Not in scope: the `hivectl` host-admin and in-agent unix sockets. Those are a
 JSON-line protocol with their own result types; RFC 9457 is an HTTP format.
 
-## Tool groups
+## Permissions
 
-A set of named `ToolGroup` values (`hive_sh4re::permissions::ToolGroup`)
-determines the MCP tool surface an agent receives, not a hardcoded
-binary flavor.
+One set of named `Permission` values (`hive_sh4re::permissions::Permission`)
+decides what an agent may do: which MCP and built-in tools it gets, and which
+host access it has.
 
-| Group | Tools |
+| Permission | Grants |
 |---|---|
 | `messaging` | `send`, `recv`, `ack_until` |
 | `meta` | `get_agent_meta` (`set_status` is always-on, see below) |
 | `inbox` | `get_loose_ends`, `cancel_loose_end`, `remind` |
-| `execution` | vestigial — `mcp__bash__run` / `mcp__bash__status` are always available unconditionally via `extraMcpServers`; this group's entries expand to non-existent `mcp__hyperhive__run` / `mcp__hyperhive__status` and have no effect. See `docs/tools/bash.md`. |
-| `lifecycle` | none |
-| `forge` | none |
-| `web_tools` | none (gates the Claude built-ins `WebFetch`/`WebSearch`, not an MCP tool) |
+| `execution` | the `bash` MCP server (`mcp__bash__run`/`status`/`kill`), rendered into the agent's MCP config only with it; a subagent gets Claude's own `Bash` instead. See `docs/tools/bash.md`. |
+| `web_tools` | the Claude built-ins `WebFetch`/`WebSearch` |
+| `manage_root_agent` | every agent's state (rw) + config (ro) bind-mounted into the holder's container, plus `/applied` and `/meta` (ro) |
 
-**Always-on tools** — `ToolGroup::ALWAYS_ON_TOOLS` exposes `set_status`,
-`compact`, and `mark_todos_done` to every agent regardless of which
-groups it holds. The operator dashboard depends on every agent
-being able to report its status chip, and the server-side `SetStatus` handler
-has no tool-group check (only length validation), so gating it would only
-desync the `--allowedTools` list from what the host actually accepts.
-Revoking `meta` therefore drops `get_agent_meta` but never `set_status`.
-`mark_todos_done` is here because producers push todos to an agent independent of
-whether it holds `inbox` — an agent without that group still needs a way to
-clear them.
+**Always-on tools** — `Permission::ALWAYS_ON_TOOLS` exposes `set_status`,
+`compact`, and `mark_todos_done` to every agent regardless of its
+permissions. The operator dashboard depends on every agent being able to
+report its status chip, and the server-side `SetStatus` handler has no
+permission check (only length validation), so gating it would only desync
+the `--allowedTools` list from what the host actually accepts. Revoking
+`meta` therefore drops `get_agent_meta` but never `set_status`.
+`mark_todos_done` is here because producers push todos to an agent whether
+or not it holds `inbox`, and an agent without it still needs to clear them.
 
-**Config storage** — per-agent tool groups live in
-`/var/lib/hyperhive/meta/tool-groups.json` (hive-c0re-owned, committed to the
-meta repo alongside `topology.json`). Format: `{ "alice": ["messaging", "meta",
-"inbox", "lifecycle"], "bob": ["messaging", "meta", "inbox"] }`. An absent entry
-means "use role default." Tool permissions are intentionally NOT configurable
-from `agent.nix` — that file changes through config PRs the manager opens, so
-letting it declare its own groups would let the manager grant itself any tool by
-submitting a config commit, bypassing the operator gate.
+**Where they live** — in the swarm, not on the hive: the `permissions` field of
+the agent's key in the `agent-permissions` KV bucket
+(`swarm-queue-client/src/agent_permissions.rs`), which swarm-controller alone
+writes. Set them with `swarmctl agent permissions get|set|clear <agent>`
+(`/api/agents/{name}/permissions`), or on the swarm UI's create-agent screen
+(`permissions` in `POST /api/agents`). A missing key or an unset field means
+the default (`Permission::default_for`): `messaging`, `meta`, `inbox`,
+`execution`, plus `manage_root_agent` for `ruth`. `"permissions": []` grants
+none.
 
-**Setting groups** — the operator sets groups via the dashboard or
-`hive-c0re::tool_groups::set_groups(name, groups)`. After a change
-`meta::sync_agents` commits the updated file; the next agent rebuild picks up
-the new `HIVE_TOOL_GROUPS` env var. Agents with no entry get no var.
+**How a change applies** —
+- The agent's harness reads its own key every 10 seconds and builds every
+  turn's `--tools`, `--allowedTools` and MCP config from the last value, so a
+  change reaches the next turn. An ACP agent's permission check reads it on
+  each request.
+- The subagent daemon reads the key on each `start`/`continue`; a running
+  subagent keeps its tools.
+- hive-c0re reads each of its agents' keys every 30 seconds
+  (`workers/swarm_permissions.rs`) into
+  `/var/lib/hyperhive/swarm-agent-permissions.json`, outside the meta repo.
+  nspawn fixes the bind mounts at container start, so when an agent's
+  `manage_root_agent` changes hive-c0re restarts it after its current turn.
+- hive-c0re copies each agent's entry from that file into the agent's
+  runtime dir (`/run/hive/swarm-permissions.json` in the container) at every
+  start and after every 30-second pass, with whether the import below is
+  still pending. The harness and the subagent daemon hold that copy until
+  their own first read succeeds, so an agent whose queue is down starts on
+  its last stored grant, not the default.
 
-**Runtime resolution** — at session start the harness reads `HIVE_TOOL_GROUPS`
-(a comma-separated list of snake_case group names injected by the meta renderer
-from `tool-groups.json`), logging and skipping unrecognised tokens. Falls back
-to `ToolGroup::AGENT_DEFAULT` (`messaging`, `meta`, `inbox`, `execution`) when
-the var is absent or empty.
+Every reader keeps its last good value on a failed read.
 
-**Updating the surface** — when you add a new `#[tool]` fn to `AgentServer`
-in `hive-agent-mcp/src/mcp/mod.rs`, add its name to the matching `ToolGroup::tools()`
-slice in `hive-sh4re/src/permissions.rs`. That's the single source of truth;
-`mcp_config::allowed_mcp_tools` (in `hive-agent/src/mcp_config.rs`) reads it at
-session start.
+**Moving off the meta repo** — on its first boot with this code a hive copies
+`meta/capabilities.json` and `meta/tool-groups.json` into the stored value,
+sends them to swarm-controller once as one list per agent (without
+`lifecycle` and `forge`, which gave no tools; the controller writes a key
+only where there is none, and only for agents that hive's wanted state
+declares), and deletes
+both files from the meta repo when the controller answers
+(`workers/permissions_import.rs`). Until then hive-c0re reads no keys, and an
+agent that reads its own key unset keeps the grant in its copy.
 
-## Capabilities
+**Not configurable from `agent.nix`** — that file changes through config PRs
+an agent can open, so letting it declare its own permissions would let an
+agent grant itself any tool by submitting a config commit, bypassing the
+operator gate.
 
-Capabilities gate system-level access that goes beyond the MCP tool surface —
-things an agent can *access*, not just *call*. Parallel to tool groups but
-orthogonal: an agent can have a tool group that registers a tool AND a capability
-that allows the underlying resource access.
-
-| Capability | Effect |
-|---|---|
-| `manage_root_agent` | may manage *any* agent: bind-mounts every agent's state (rw) + config (ro) into the holder's container, plus `/applied` and `/meta` (ro). Takes effect on the holder's next container rebuild/restart |
-
-**Config storage** — per-agent capabilities live in
-`/var/lib/hyperhive/meta/capabilities.json` alongside `tool-groups.json`.
-Format: `{ "ruth": ["manage_root_agent"] }`.
-An absent entry means "no extra capabilities." `render_flake` in `meta.rs`
-reads this file and injects `HIVE_CAPABILITIES` (comma-separated
-`snake_case` names) into each agent's systemd service env; absent entries emit
-no env var so agents without capabilities don't trigger a spurious rebuild.
-
-**Setting capabilities** — the operator sets capabilities via the
-C4P4B1L1T13S section in the dashboard's P3RM1SS10NS tab.
-`hive-c0re::capabilities::set_caps(name, caps)` is the write path.
-After a change `meta::sync_agents` commits the updated file; the next agent
-rebuild picks up the new `HIVE_CAPABILITIES` env var.
-
-**Runtime resolution** — at session start the harness reads `HIVE_CAPABILITIES`
-and resolves each token to a `Capability` variant, logging and skipping
-unrecognised ones. An absent or empty var means no extra capabilities.
-
-**Capability NOT configurable from `agent.nix`** — same reasoning as tool
-groups: an agent that could grant its own capabilities via a config commit would
-bypass the operator approval gate.
-
-**Adding a new capability** — add a variant to `Capability` in
-`hive-sh4re/src/permissions.rs` + an arm to `as_str`. Add it to `Capability::ALL`
-(the source of truth for the permissions UI columns). Implement the access
-check in the relevant handler (`hive-c0re/src/socket_server/mod.rs`,
-`coordinator.rs`, or a handler under `hive-c0re/src/dashboard/`).
+**Adding to the set** — add a variant to `Permission` in
+`hive-sh4re/src/permissions.rs` and to `Permission::ALL`, and enforce it where
+it applies. A new `#[tool]` fn on `AgentServer` (`hive-agent-mcp/src/mcp/mod.rs`)
+goes into the matching `Permission::tools()` slice: that's the single source
+of truth `mcp_config::allowed_mcp_tools` (`hive-agent/src/mcp_config.rs`)
+reads each turn.
 
 ## Async forms
 
diff --git a/docs/scheduler/coordinator.md b/docs/scheduler/coordinator.md
index 4634269f..82010b29 100644
--- a/docs/scheduler/coordinator.md
+++ b/docs/scheduler/coordinator.md
@@ -71,9 +71,8 @@ Cheap — no build slot:
 | `PurgeState`         | the `purge = true` half of a destroy: delete the agent's state subvolume (via hive-priv) plus its state/applied dirs. Own node because it's conditional and the irreversible step                                                                                                                                                                                                                          |
 | `DestroyBookkeeping` | the post-destroy tail — meta sync, drop the power intent, notify the manager, rescan, re-emit the tombstone. Same split rationale as `RebuildBookkeeping`/`Swap`. The destructive work is `PurgeState`'s                                                                                                                                                                                                   |
 | `SetWanted`          | write the durable power intent (`wanted = Up`/`Offline`) as the head node of a power-op DAG. Takes the agent lease even though it's a store write, so the intent write and the tail `Reconcile` are atomic per-agent — two racing power ops can't clobber each other's intent before either reconciles                                                                                                     |
-| `EmitRebuilt`        | tail of a rebuild/perm-change — emit the agent's `Rebuilt` manager event (ok/fail per outcome, nothing on cancel). One node per agent _and_ per outcome                                                                                                                                                                                                                                                    |
+| `EmitRebuilt`        | tail of a rebuild — emit the agent's `Rebuilt` manager event (ok/fail per outcome, nothing on cancel). One node per agent _and_ per outcome                                                                                                                                                                                                                                                                |
 | `WriteDropin`        | `set_nspawn_flags` + `set_resource_limits` + daemon-reload                                                                                                                                                                                                                                                                                                                                                 |
-| `WritePermFile`      | commit `tool-groups.json` / `capabilities.json` (single git commit under `META_LOCK`) + emit the P3RM1SS10NS snapshots                                                                                                                                                                                                                                                                                     |
 | `ForgeSweep`         | one-shot boot-time forge user/token sweep for every container (`forge::ensure_all`) as a first-class node, so it shows as real work on the dashboard instead of running invisibly in a bare `tokio::spawn`. Agentless                                                                                                                                                                                      |
 | `MatrixSweep`        | matrix user/space sweep (`matrix::ensure_all`): the boot-time instance, plus one every 30 min from a loop in `main.rs`. Holds `Resource::MatrixSweep` (capacity 1), so two passes never overlap; each tick queues its own pass, which waits for the resource if one is already live. Agentless                                                                                                             |
 | `KnowledgePull`      | `/knowledge` pull (`knowledge::pull`): at boot (commits that landed while `hive-c0re` was down), on the swarm knowledge-changed event, and hourly as a fallback. Holds `Resource::KnowledgeTree` (capacity 1), so two pulls never overlap on the working tree; each trigger queues its own pass, which waits for the resource if one is already live. Agentless                                            |
@@ -90,7 +89,7 @@ Two further layers protect the meta repo across _windows_ that span multiple
 
 - **The deploy window** (`Resource::MetaWindow`): a global, capacity-1 queue
   resource declared by every node kind that mutates the meta repo — `MetaSync`,
-  `MetaLock`, `WritePermFile` and `Provision`'s agent registration. Two meta
+  `MetaLock` and `Provision`'s agent registration. Two meta
   mutations can therefore never interleave, so no commit lands inside another
   node's window. It's a queue resource rather than a runtime mutex
   because a subtree root holds a resource across its whole subtree, which
@@ -139,7 +138,6 @@ restart(a..):  online a: [Signal→Drain→ if graceful] StopForUpdate(a) → Re
                offline a: Reconcile(a)  (nothing to stop; Reconcile converges to existing wanted)
 start(a..):    a: SetWanted(a,Up) → Reconcile(a)   (down+stale ⇒ SetWanted(a,Up) → «rebuild subgraph»)
 spawn(a):          [wanted=Up at deploy]   Provision(a) → Create(a) → WriteDropin(a) → Reconcile(a)
-perm-change(a):    WritePermFile(a) → «rebuild subgraph»
 meta-update(inp):  MetaLock(inp) →(in-DAG) «rebuild subgraph» per affected agent
 boot:              (if any rev marker stale) MetaLock(hyperhive) →(in-DAG) «rebuild subgraph» per stale agent;
                    plus Reconcile(a) for every drifted agent  (all ONE DAG)
@@ -215,7 +213,7 @@ resources are free. Resources:
    (`SetWanted` is a store write, not a container op, but takes the lease anyway
    so a power-op DAG's intent write + reconcile is atomic — two racing ops can't
    clobber intent before either reconciles.) **Lease-exempt**: `MetaSync`,
-   `Prebuild`, `Provision`, `MetaLock`, `WritePermFile` — they
+   `Prebuild`, `Provision`, `MetaLock` — they
    touch the store / meta, not the running container, which is exactly why a
    stop can land while another DAG's prebuild is still building. Also exempt, for a different
    reason, are the rebuild subtree's own members (`StopForUpdate`, `Swap`,
diff --git a/docs/swarm/ui.md b/docs/swarm/ui.md
index 4bdec1a9..0d88aeff 100644
--- a/docs/swarm/ui.md
+++ b/docs/swarm/ui.md
@@ -7,18 +7,18 @@ domain, covers host-level detail for one hive.
 
 ## What it shows
 
-| route                                          | what                                                                                                                                        |
-| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| `/`                                            | the start page: the swarm's name over a digital-rain backdrop; the swarm name in the header links here                                      |
-| `/hives`                                       | the hive directory, each hive with its last reported status                                                                                 |
-| `/agents`                                      | every agent: status, config PR, wanted state, inference settings, resource caps; create agents, link forge, matrix and GitHub accounts      |
-| `/agents/<name>/terminal`                      | one agent's live terminal                                                                                                                   |
-| `/agents/<name>/subagents/<subagent>/terminal` | one of that agent's subagents' live terminal                                                                                                |
-| `/alerts`                                      | the alerts the swarm's Grafana holds now (firing, pending, no data, error), read through the controller with a Viewer service-account token |
-| `/jobs`                                        | the controller's job graph — where agent creation and credential mints show progress                                                        |
-| `/schedules`                                   | the scheduled prompts: add, edit, pause, resume and remove                                                                                  |
-| `/issues`                                      | a cross-repo issue report                                                                                                                   |
-| `/review`                                      | the review classifier: its recent runs, a try-out on a real PR, and its settings                                                            |
+| route                                          | what                                                                                                                                                            |
+| ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `/`                                            | the start page: the swarm's name over a digital-rain backdrop; the swarm name in the header links here                                                          |
+| `/hives`                                       | the hive directory, each hive with its last reported status                                                                                                     |
+| `/agents`                                      | every agent: status, config PR, wanted state, inference settings, resource caps; create agents (with their permissions), link forge, matrix and GitHub accounts |
+| `/agents/<name>/terminal`                      | one agent's live terminal                                                                                                                                       |
+| `/agents/<name>/subagents/<subagent>/terminal` | one of that agent's subagents' live terminal                                                                                                                    |
+| `/alerts`                                      | the alerts the swarm's Grafana holds now (firing, pending, no data, error), read through the controller with a Viewer service-account token                     |
+| `/jobs`                                        | the controller's job graph — where agent creation and credential mints show progress                                                                            |
+| `/schedules`                                   | the scheduled prompts: add, edit, pause, resume and remove                                                                                                      |
+| `/issues`                                      | a cross-repo issue report                                                                                                                                       |
+| `/review`                                      | the review classifier: its recent runs, a try-out on a real PR, and its settings                                                                                |
 
 Everything it shows comes from [`swarm-controller`](../../swarm-controller/README.md).
 An agent created here or with `swarmctl agent create` starts `paused`; set it
diff --git a/docs/tools/bash.md b/docs/tools/bash.md
index 0509ad83..536e57f0 100644
--- a/docs/tools/bash.md
+++ b/docs/tools/bash.md
@@ -7,11 +7,12 @@ by default (`lib.mkDefault`, with `allowedTools = ["*"]`) — an `agent.nix`
 can override or drop the entry, so this is a default, not an
 unconditional grant. Even where the entry is present, the server is only
 actually rendered into an agent's claude config when the agent also
-holds the **`execution`** tool group: `extra_server_required_group` in
+holds the **`execution`** permission: `extra_server_required_permission` in
 `hive-agent/src/mcp_config.rs` suppresses it entirely without that
-group, so an agent lacking `execution` gets no `mcp__bash__*` tools at
-all, not just an unused grant. See "Relationship to the `execution` tool
-group" below.
+permission, so an agent lacking `execution` gets no `mcp__bash__*` tools at
+all, not just an unused grant. The harness rewrites the config each turn,
+so a change applies at the next one. See "Relationship to the
+`execution` permission" below.
 
 ## Tools
 
@@ -122,14 +123,14 @@ unread rooms. An inline `wait_seconds` / `status` observation that already
 delivered the result instead clears the keyed todo, so no redundant
 loose-end follows.
 
-## Relationship to the `execution` tool group
+## Relationship to the `execution` permission
 
-`ToolGroup::Execution` (in `AGENT_DEFAULT`) is the real gate on bash:
-`extra_server_required_group` (in `hive-agent/src/mcp_config.rs`)
+`Permission::Execution` (in `Permission::DEFAULT`) is the real gate on bash:
+`extra_server_required_permission` (in `hive-agent/src/mcp_config.rs`)
 controls whether the `bash` MCP server reaches the agent's claude
 config at all, suppressing every `mcp__bash__*` tool
 when absent — not just leaving them unused. Its own `tools()` returns
 `&[]`: `mcp__bash__run`/`status`/`kill` live on the separate `bash` MCP
-server that `extra_server_required_group` gates, not on the
+server that `extra_server_required_permission` gates, not on the
 `mcp__hyperhive__*` allowlist `tools()` builds. Removing `execution`
-from an agent's groups **does** remove bash availability.
+from an agent's permissions **does** remove bash availability.
diff --git a/docs/tools/subagent.md b/docs/tools/subagent.md
index 287bff8d..3d35c8f7 100644
--- a/docs/tools/subagent.md
+++ b/docs/tools/subagent.md
@@ -399,23 +399,24 @@ particular `--tools` does **not** filter `mcp__*` tools.
 
 **A subagent gets exactly the built-ins its parent agent has, plus one
 deliberate exception** — the base resolution
-(`hive_sh4re::permissions::subagent_builtin_tools_arg`, wrapping the
-harness's own `builtin_tools_for`) from the same `HIVE_TOOL_GROUPS`:
+(`hive_sh4re::permissions::subagent_builtin_tools_for`, wrapping the
+harness's own `builtin_tools_for`) over the agent's permissions, which the
+daemon reads from the swarm on each `start`/`continue`:
 `Edit`, `Glob`, `Grep`, `Read`, `Skill`, `Write`, plus `WebFetch`/
-`WebSearch` for an agent granted the `web_tools` tool group and not
-otherwise. See
+`WebSearch` for an agent granted `web_tools` and not otherwise. A running
+subagent keeps the tools it started with. See
 [the harness's own allowlist](../turn-loop/mcp.md#tool-allowlist-hive_sh4repermissionsallowed_builtin_tools)
 for what that list contains and why.
 
 The exception: **a subagent gets Claude's built-in `Bash` iff its parent
-holds the `execution` tool group** — the group that already grants the
+holds the `execution` permission** — the permission that already grants the
 parent shell execution, via the out-of-process `bash` MCP server
 (`mcp__bash__run`/`status`/`kill`). A subagent has no MCP server of its
 own by default (see [MCP servers](#mcp-servers---strict-mcp-config)
 below), so there is no `mcp__bash__*` for it to inherit that capability
 through; it gets Claude's own tool instead. The rule is the capability
 transfers, not the mechanism — the parent itself never gains built-in
-`Bash` no matter which groups it holds, only a subagent spawned by an
+`Bash` no matter which permissions it holds, only a subagent spawned by an
 `execution`-holding parent does.
 
 Inheriting rather than listing is the point: a hardcoded subagent list
diff --git a/docs/tools/swarmctl-cli.md b/docs/tools/swarmctl-cli.md
index 3a54968c..5cfb4440 100644
--- a/docs/tools/swarmctl-cli.md
+++ b/docs/tools/swarmctl-cli.md
@@ -12,6 +12,10 @@ This document contains the help content for the `swarmctl` command-line program.
 * [`swarmctl agent inference get`↴](#swarmctl-agent-inference-get)
 * [`swarmctl agent inference set`↴](#swarmctl-agent-inference-set)
 * [`swarmctl agent inference clear`↴](#swarmctl-agent-inference-clear)
+* [`swarmctl agent permissions`↴](#swarmctl-agent-permissions)
+* [`swarmctl agent permissions get`↴](#swarmctl-agent-permissions-get)
+* [`swarmctl agent permissions set`↴](#swarmctl-agent-permissions-set)
+* [`swarmctl agent permissions clear`↴](#swarmctl-agent-permissions-clear)
 * [`swarmctl schedule`↴](#swarmctl-schedule)
 * [`swarmctl schedule add`↴](#swarmctl-schedule-add)
 * [`swarmctl schedule list`↴](#swarmctl-schedule-list)
@@ -66,6 +70,7 @@ Manage agents across the swarm
 * `create` — Queue creation of a new agent on a hive in this swarm
 * `mint-forge-token` — Check one agent's forge token, and mint it if it's missing or stale
 * `inference` — Show the model, effort, subagent models and subagent cap the swarm sets for an agent, or change the model, effort and subagent models
+* `permissions` — Show or change the permissions the swarm grants an agent
 
 
 
@@ -198,6 +203,77 @@ Clear every field for an agent, so it goes back to its own values
 
 
 
+## `swarmctl agent permissions`
+
+Show or change the permissions the swarm grants an agent.
+
+The agent applies its tool permissions at its next turn; the hive running it restarts it, after its current turn, when `manage_root_agent` changes. Unset leaves the agent on the default: `messaging`, `meta`, `inbox`, `execution`, plus `manage_root_agent` for `ruth`.
+
+**Usage:** `swarmctl agent permissions <COMMAND>`
+
+###### **Subcommands:**
+
+* `get` — Show the permissions the swarm grants an agent, or that it sets none
+* `set` — Replace the permissions the swarm grants an agent
+* `clear` — Clear the agent's permissions, so the default applies again
+
+
+
+## `swarmctl agent permissions get`
+
+Show the permissions the swarm grants an agent, or that it sets none
+
+**Usage:** `swarmctl agent permissions get [OPTIONS] <AGENT>`
+
+###### **Arguments:**
+
+* `<AGENT>` — Agent name
+
+###### **Options:**
+
+* `--controller-socket <PATH>` — swarm-controller's unix socket.
+
+   Supplied by the nix module that installs this binary, from the same `socketPath` option the daemon binds; falls back to `SWARM_CONTROLLER_SOCKET`.
+
+
+
+## `swarmctl agent permissions set`
+
+Replace the permissions the swarm grants an agent
+
+**Usage:** `swarmctl agent permissions set [OPTIONS] --permissions <PERMISSIONS> <AGENT>`
+
+###### **Arguments:**
+
+* `<AGENT>` — Agent name. A hive must declare it
+
+###### **Options:**
+
+* `--permissions <PERMISSIONS>` — The permissions to grant, comma-separated: any of `messaging`, `meta`, `inbox`, `execution`, `web_tools`, `manage_root_agent`. `--permissions ''` grants none
+* `--controller-socket <PATH>` — swarm-controller's unix socket.
+
+   Supplied by the nix module that installs this binary, from the same `socketPath` option the daemon binds; falls back to `SWARM_CONTROLLER_SOCKET`.
+
+
+
+## `swarmctl agent permissions clear`
+
+Clear the agent's permissions, so the default applies again
+
+**Usage:** `swarmctl agent permissions clear [OPTIONS] <AGENT>`
+
+###### **Arguments:**
+
+* `<AGENT>` — Agent name
+
+###### **Options:**
+
+* `--controller-socket <PATH>` — swarm-controller's unix socket.
+
+   Supplied by the nix module that installs this binary, from the same `socketPath` option the daemon binds; falls back to `SWARM_CONTROLLER_SOCKET`.
+
+
+
 ## `swarmctl schedule`
 
 Manage scheduled prompts.
diff --git a/docs/turn-loop/README.md b/docs/turn-loop/README.md
index 2c8eed49..f3a70e16 100644
--- a/docs/turn-loop/README.md
+++ b/docs/turn-loop/README.md
@@ -177,7 +177,7 @@ harness between turns.
 One harness serve binary (`hive-agent`, with its `hive-agent-mcp`
 sibling), one shared `nix/agent-modules/` tree, one service unit
 (`systemd.services.hive-agent`) for all agents. Privilege
-differences live server-side in the broker socket (which tool groups
+differences live in the agent's swarm permissions and the broker socket (which tools
 and manager-surface calls each agent receives).
 
 `agent.nix` and `ruth.nix` both import the shared `nix/agent-modules/`.
@@ -250,7 +250,7 @@ The rest lives alongside this page, in three topic files:
   custom static files, connectivity overrides, claude plugins, cargo message
   filtering).
 - **[mcp.md](mcp.md)** — the MCP tool surface claude sees: core tools,
-  privileged tool groups, self-wake, authoritative state, the tool envelope,
+  permission-gated tools, self-wake, authoritative state, the tool envelope,
   and the built-in tool allowlist.
 
 Per-subsystem impl detail lives in each module's `//!` doc-comment; these pages
diff --git a/docs/turn-loop/mcp.md b/docs/turn-loop/mcp.md
index bd6c04fe..67853254 100644
--- a/docs/turn-loop/mcp.md
+++ b/docs/turn-loop/mcp.md
@@ -22,10 +22,11 @@ toggle (default `false`) — see
 [`docs/tools/subagent.md`](../tools/subagent.md#mcp-servers-available-to-a-subagent)
 for what reaches a subagent's own `--mcp-config` and what doesn't.
 
-Tool groups (`HIVE_TOOL_GROUPS`) gate tool access. The default
-preset (`AGENT_DEFAULT`) includes `messaging`, `meta`, `inbox`, and
-`execution`. The privileged `lifecycle` group
-is opt-in via the P3RM1SS10NS tab.
+The agent's permissions gate tool access
+([`docs/process/conventions.md#permissions`](../process/conventions.md)).
+The default (`Permission::DEFAULT`) is `messaging`, `meta`, `inbox` and
+`execution`; `swarmctl agent permissions set` changes it, and the next turn
+runs on the change.
 
 ## Core tools (always available)
 
@@ -106,7 +107,7 @@ hive_name?, swarm_name?, matrix_accounts? }`. `matrix_accounts` is a
   `homeserver`); omitted for agents with no matrix provisioning. Omit
   `name` to query self.
 
-**Always-on, no tool group**: `set_status(text)`, `compact()`,
+**Always-on, no permission needed**: `set_status(text)`, `compact()`,
 `mark_todos_done(ids)`.
 
 - `set_status` — set a free-text status string visible on the
@@ -130,26 +131,23 @@ hive_name?, swarm_name?, matrix_accounts? }`. `matrix_accounts` is a
   unknown or already-done ids are silently skipped. Dials the same
   in-agent todo socket as `cancel_loose_end`'s `todo` kind.
 
-## Privileged tools (by tool group)
+## Privileged tools (by permission)
 
 - **Bash execution** (`execution`) — background shell tasks. See
   [`docs/tools/bash.md`](../tools/bash.md).
 - **Subagent spawning** — nested sessions on the agent's own runtime
   (claude or ACP, via `hive-runtime`) as background tasks, shipped
-  default-on like bash execution; no tool group gates it. See
+  default-on like bash execution; no permission gates it. See
   [`docs/tools/subagent.md`](../tools/subagent.md).
-- **Lifecycle + config** (`lifecycle`) — gates nothing.
-  Config changes go through a forge PR on `agent-configs/<name>` — see
+- **Config changes** — no permission: they go through a forge PR on
+  `agent-configs/<name>` — see
   [`docs/agent-lifecycle/config-changes.md`](../agent-lifecycle/config-changes.md).
-- **Forge repos** (`forge`) — gates nothing.
 - **Web egress** (`web_tools`) — enables Claude's built-in `WebFetch`
   and `WebSearch` tools (not MCP tools; added directly to the
-  `--allowedTools` list). Off by default; add the group in the
-  P3RM1SS10NS tab and rebuild to enable.
-- **Capabilities** — orthogonal to tool groups, set via the P3RM1SS10NS
-  tab. No capability registers an MCP tool today; the full list and their
-  effects are in
-  [`docs/process/conventions.md#capabilities`](../process/conventions.md).
+  `--allowedTools` list). Off by default.
+- **Recovery mounts** (`manage_root_agent`) — no tool: every agent's state
+  and config mounted into this agent's container. See
+  [`docs/process/conventions.md#permissions`](../process/conventions.md).
 - **Matrix MCP + extra servers** — `mcp__matrix__*` tools and
   per-agent extra MCP config. See
   [`docs/tools/matrix.md`](../tools/matrix.md).
@@ -199,7 +197,7 @@ status hint lives in the wake prompt + UI header, not here.
 ## Tool allowlist (`hive_sh4re::permissions::ALLOWED_BUILTIN_TOOLS`)
 
 The built-in list and the `--tools` value it resolves to live in
-`hive-sh4re` alongside `ToolGroup`, not in the harness, because the
+`hive-sh4re` alongside `Permission`, not in the harness, because the
 subagent daemon spawns its own `claude` and must resolve the same set —
 see [`docs/tools/subagent.md`](../tools/subagent.md).
 
@@ -207,15 +205,15 @@ see [`docs/tools/subagent.md`](../tools/subagent.md).
   `Skill` is what makes an installed plugin's `SKILL.md` invokable —
   without it, a skill's `description` frontmatter never gets seen by
   the model no matter how well it matches the task.
-- Tool-group-gated built-ins: `WebFetch`, `WebSearch` (added once the
-  operator enables the `web_tools` tool group — see P3RM1SS10NS tab).
+- Permission-gated built-ins: `WebFetch`, `WebSearch` (added once the
+  agent holds `web_tools`).
 - Denied by omission (absent from the harness `--tools` /
   `--allowedTools`, so they "literally don't exist" in a harness turn):
   `Bash`, `Task`, `NotebookEdit`, `TodoWrite`.
 - Additionally in the managed-settings deny list
   (`/etc/claude-code/managed-settings.json`, un-overridable): `Task`,
   `TodoWrite`. `Bash` **isn't** in the managed deny — see below.
-- Allowed MCP tools: as listed above (by tool group).
+- Allowed MCP tools: as listed above (by permission).
 
 The autonomous harness disallows `Bash` — shell execution goes
 through `mcp__bash__run` (background tasks with structured output +
@@ -230,7 +228,7 @@ completion wake landing in the wrong session (the harness inbox) for a
 choom-started task; `choom` is an operator action (root or `hive-admin`),
 so built-in shell there stays within the existing trust boundary. The bash MCP server
 (`run` / `status` / `kill`) uses `allowedTools = ["*"]` so all
-`mcp__bash__*` tools are always available regardless of tool groups.
+`mcp__bash__*` tools are available whenever the agent holds `execution`.
 
-`WebFetch` / `WebSearch` are off by default; enable the `web_tools`
-tool group in the P3RM1SS10NS tab and rebuild the agent to enable them.
+`WebFetch` / `WebSearch` are off by default; grant `web_tools`
+(`swarmctl agent permissions set`) to enable them from the next turn.
diff --git a/docs/web-ui/README.md b/docs/web-ui/README.md
index 9c8f2fe4..903cb6c0 100644
--- a/docs/web-ui/README.md
+++ b/docs/web-ui/README.md
@@ -16,14 +16,13 @@ Settings, Core). Every page links back to H0M3, so you're
 never more than one step from the hub.
 
 The **dashboard** itself (`/dashboard.html`) is where you'll spend most
-of your time. It's a single page with five tabs:
+of your time. It's a single page with four tabs:
 
 - **4G3NTS** — every agent, live. This is the default tab and the one
   you'll check most.
 - **R3BU1LD QU3U3**, **M3T4 1NPUTS** and **BUILD L0GS** — the build
   lifecycle: the rebuild queue with a live log of whatever is building,
   the meta flake inputs you can bump, and the build log history.
-- **P3RM1SS10NS** — what tools and system-level access each agent has.
 
 Everything else lives on its own page instead, all reachable from the
 H0M3 hub: **Flow** (`/flow.html`, the raw live message stream across
@@ -58,10 +57,10 @@ shows as "needs update."
 streaming log of whatever's currently building. Useful right after
 merging a config change or bumping a flake input.
 
-**Grant or revoke a tool/capability.** P3RM1SS10NS is a checkbox matrix
-— rows are agents, columns are tool groups or capabilities. Nothing
-takes effect until you hit **save all** at the bottom of the tab; a
-save queues a rebuild for whichever agents actually changed.
+**Grant or revoke a permission.** Not on the hive dashboard: an agent's
+permissions live in the swarm. Set them with `swarmctl agent permissions`,
+or on the swarm UI's create-agent screen when creating the agent; see
+[`process/conventions.md`](../process/conventions.md#permissions).
 
 **Read an agent's logs.** Logs aren't in the hive dashboard. Every
 hive ships its agents', daemons' and infra containers' journals to the
diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md
index 6cfd43f1..74c1223e 100644
--- a/docs/web-ui/dashboard.md
+++ b/docs/web-ui/dashboard.md
@@ -20,7 +20,7 @@ from the dashboard tab strip.
 - **← home back-link**: top-left of the chrome, links to the H0M3 hub
   at `/`. Every surface links back to the hub rather than to each other.
 - **Tab strip**: `◆ 4G3NTS ◆`, `◆ R3BU1LD QU3U3 ◆`, `◆ M3T4 1NPUTS ◆`,
-  `◆ BUILD L0GS ◆`, `◆ P3RM1SS10NS ◆`. In-page tabs only —
+  `◆ BUILD L0GS ◆`. In-page tabs only —
   the SYST3M panels live on the
   standalone **C0R3** page (`/core.html`), and FL0W / ST4TS
   live on their own pages too, all reachable from the
@@ -77,19 +77,15 @@ H0M3 hub (served at
 `/core.html`), with minimal chrome: a `← home` back-link and a single pane,
 **K3PT ST4T3**. The page is its own esbuild bundle (`core.js`) that
 cold-loads `/api/state` and subscribes to `/api/dashboard/stream` for
-`tombstones_changed`, `capabilities_changed`, and `tool_groups_changed`
-(the latter two re-render the stale-perms sub-section when permission
-data changes). (Rebuild queue and meta inputs are dashboard tabs — see
-below.)
+`tombstones_changed`. (Rebuild queue and meta inputs are dashboard
+tabs — see below.)
 
 Per-container CPU, memory and disk load isn't shown in the hive UI. The
 same figures go out as OTEL metrics and appear in Grafana (see
 [observability](../scheduler/observability.md)). An agent's CPU and memory
 caps live per agent in the swarm UI.
 
-**K3PT ST4T3** — two sub-sections on one pane:
-
-*Tombstones*: agents with kept state and **no container** (size + age +
+**K3PT ST4T3** — agents with kept state and **no container** (size + age +
 claude-creds badge). One action: `PURG3` (wipes state + applied
 dirs; `POST /api/purge-tombstone/{name}`).
 
@@ -104,14 +100,6 @@ container is all hive-c0re can actually prove. Fixing it properly
 needs a recorded destroy — **deferred** to the swarm-controller /
 snapshot-storage rework where the problem changes shape.
 
-*Stale permission entries*: agents with explicit capability or
-tool-group JSON entries but no live container — typically renamed or
-deleted agents whose entries persisted in `capabilities.json` /
-`tool-groups.json`. Loaded when the page opens;
-autorefreshes on `capabilities_changed` + `tool_groups_changed` SSE
-events. Each ghost agent gets a `✕ clear perms` button
-(`DELETE /api/permissions/{name}`).
-
 ## Build tabs (`#rebuild`, `#meta`, `#buildlogs`)
 
 The build lifecycle — rebuild queue, live build log, meta inputs, and
@@ -228,94 +216,6 @@ badge with a ticking elapsed-time chip; expanding streams output via
 (suspends on manual scroll-up). Deep-link: `?id=N#buildlogs` opens the
 entry with that id pre-expanded.
 
-## P3RM1SS10NS tab
-
-Per-agent permission configuration. Two sections, each rendered as a
-column-driven checkbox matrix: rows are agents, columns are the
-permission names fetched from hive-c0re. The column list is
-authoritative — adding a new tool-group or capability to hive-c0re
-requires no UI change; the new column appears automatically.
-
-The snapshot carries `agents` (the full manageable roster — live
-containers ∪ agents with an explicit entry) and `effective` (per-agent
-explicit-or-role-default values) alongside the explicit `assignments`
-map. Rows come from `agents` so **agents on defaults always appear**
-(not just those with an explicit entry), and checkboxes reflect the
-`effective` values so a default agent shows the groups it actually runs
-with rather than blank — which also means saving it won't silently
-strip those defaults. The `(default)` badge keys off absence from
-`assignments` (no explicit entry).
-
-Fetches fire on tab activation (not page-load) to avoid unnecessary
-work when the operator never visits this tab. Live mutations from the
-rebuild-queue worker are also pushed via the `capabilities_changed` /
-`tool_groups_changed` SSE events (same payload shape as the GET
-endpoints), so an open P3RM1SS10NS tab reflects worker-applied changes
-without requiring navigation. Tab-activation re-fetches remain as a
-safety net for reconnect windows.
-
-**C4P4B1L1T13S** — per-agent capability grants. Capabilities unlock
-gated MCP tools and system-level access beyond the default agent
-surface. A saving POST queues a rebuild for the affected agent so the
-new `HIVE_CAPABILITIES` env var takes effect in the next session.
-
-The current capabilities are:
-
-| Name | Effect |
-|------|--------|
-| `manage_root_agent` | mounts every agent's state (rw) + config (ro) into this agent's container so it can manage/recover any agent |
-
-Each row is one agent. Columns are the capability names returned by
-`GET /api/capabilities` as `caps: Vec<String>`. Checking or unchecking
-boxes only stages the change in-browser; the browser writes nothing until
-the operator selects the page-level **save all** button (described below). Row
-values follow the `effective`/`assignments` rule described above.
-
-<!-- vale write-good.Passive = NO -->
-**T00L GR0UPS** — per-agent tool-group permissions. Tool groups are
-named buckets of MCP tools; each agent starts with a role default
-(sub-agents: `messaging`, `meta`, `inbox`, `execution` —
-`ToolGroup::AGENT_DEFAULT`; hive-c0re seeds the root agent to
-`ToolGroup::MANAGER_DEFAULT` — `messaging`, `meta`, `inbox`,
-`lifecycle`, `execution`,
-that is, every group except `forge` and `web_tools`). Checking /
-unchecking stages which groups are active for the agent; the
-page-level **save all** button (below) commits it. Columns come from
-`GET /api/tool-groups`. hive-c0re queues a rebuild so `HIVE_TOOL_GROUPS`
-takes effect.
-<!-- vale write-good.Passive = YES -->
-
-The current tool groups are: `messaging`, `meta`, `inbox`, `lifecycle`,
-`forge`, `execution`, `web_tools`. All listed in `ToolGroup::ALL` in `hive-sh4re`. The
-`web_tools` group is special: it carries no MCP tools; instead it adds
-Claude's built-in `WebFetch` and `WebSearch` to `--tools` /
-`--allowedTools` for that agent session.
-
-Both tables share the same visual shape: `.cap-table-wrap` /
-`.tg-table-wrap` outer scroll container, `thead` with a label column
-(`.cap-agent-col` / `.tg-agent-col`) + one column per permission
-(`.cap-col` / `.tg-group-col`). Each tbody row is one agent: a name cell
-and its checkbox cells, where each checkbox carries `data-baseline` (its
-render-time state) and the row carries `data-agent` for dirty-tracking.
-
-**Saving — one button for the whole page.** No per-row save
-buttons exist. A single page-level `.perm-save-bar` with a **save all (N
-agents)** button sits at the bottom of the pane, enabled only when some
-checkbox diverges from its baseline. Selecting it diffs every checkbox
-across *both* matrices and POSTs one batch to `POST /api/permissions` as
-`{ changes: [ { agent, tool_groups?, capabilities? } ] }` — the batch
-includes only the perm-types that actually changed for each agent (an
-omitted field leaves that file untouched; an included array fully
-replaces it).
-hive-c0re coalesces an agent's capabilities + tool-groups into a
-single rebuild, so changing both for one agent is one rebuild, not two.
-The batch is atomic: it validates every change first and on any error
-rejects the whole POST (`{error}`, nothing applied); a clean 200 (`ok`)
-flips the bar to a queued→rebuilding state and re-fetches both tables.
-Live `capabilities_changed` / `tool_groups_changed` events re-render the
-matrices unless the section has unsaved edits, so an in-progress edit set
-isn't clobbered.
-
 ## ST4TS page (`/stats.html`)
 
 Hive-wide turn statistics, aggregated across every agent's
@@ -754,46 +654,6 @@ below — some endpoints aren't in it yet.
 - `POST /api/cancel-reminder/{id}` — hard-delete a pending reminder.
 - `POST /api/retry-reminder/{id}` — re-arm a reminder whose delivery
   failed (clears the failure state so the scheduler retries).
-- `GET /api/tool-groups` — returns `{ groups: Vec<String>,
-  assignments: BTreeMap<String, Vec<String>>,
-  descriptions: BTreeMap<String, String> }`. `groups` is the
-  ordered list of all known tool-group names (drives the column
-  headers in the P3RM1SS10NS tab); `assignments` is the per-agent
-  override map (absent agents use the role default); `descriptions`
-  maps each group name to a short human-readable string surfaced as
-  a column-header tooltip on hover.
-- `POST /api/tool-groups/{agent}` — body `{ groups: ["name", …] }`.
-  Writes the tool-group set for `{agent}` to
-  `/var/lib/hyperhive/meta/tool-groups.json` and queues a rebuild so
-  `HIVE_TOOL_GROUPS` takes effect. Agent name validated;
-  `guard_agent_name` applied.
-- `GET /api/capabilities` — returns `{ caps: Vec<String>,
-  assignments: BTreeMap<String, Vec<String>>,
-  descriptions: BTreeMap<String, String> }`. `caps` is the
-  ordered list of all known capability names; `assignments` is the
-  per-agent grant map (absent agents have no extra capabilities);
-  `descriptions` maps each capability name to a short human-readable
-  string surfaced as a column-header tooltip on hover.
-- `POST /api/capabilities/{agent}` — body `{ caps: ["name", …] }`.
-  Writes the capability set for `{agent}` to
-  `/var/lib/hyperhive/meta/capabilities.json` and queues a rebuild so
-  `HIVE_CAPABILITIES` takes effect. Agent name validated;
-  unknown capability strings rejected (400). `guard_agent_name`
-  applied.
-- `POST /api/permissions` — batch perm apply for the save-all
-  permissions button. Body
-  `{ changes: [{ agent, tool_groups?: ["name", …], capabilities?: ["name", …] }] }`.
-  Sparse per agent: an omitted field leaves that perm-type untouched,
-  an empty array clears it, a populated array fully replaces it (same
-  replace semantics as the per-agent endpoints above). Each affected
-  agent gets ONE combined `PermChange` queue entry, so changing both
-  an agent's tool-groups and capabilities triggers a single rebuild,
-  not two. **Atomic**: the endpoint validates every change first (agent names via
-  `guard_agent_name`, group + capability names) and on any validation
-  error writes or enqueues nothing (non-2xx `{ error }`); it skips
-  rows with both fields omitted rather than erroring on them.
-  Returns `200 "ok"` on
-  success.
 - `POST /api/meta-update` — `nix flake update` the selected
   `meta/flake.lock` inputs, then rebuild the affected agents.
 - `GET /api/dashboard/stream` — unified live event channel:
@@ -841,18 +701,6 @@ payload):
   operator cancel / retry (`/api/system/reminders/*`), `cancel_loose_end`
   with Reminder kind, and the scheduler tick after each delivery
   batch (`reminder_scheduler`).
-- `capabilities_changed` (seq, caps: `Vec<str>`, descriptions: map,
-  assignments: `BTreeMap<String, Vec<String>>`) — full snapshot of
-  capability grants. Emitted from the rebuild-queue worker after a
-  `PermChange` / Capabilities entry commits the JSON file. Payload
-  matches `GET /api/capabilities` shape so the client can call
-  `renderCapabilities` directly. P3RM1SS10NS tab subscribes; activation
-  re-fetch still runs as a safety net.
-- `tool_groups_changed` (seq, groups: `Vec<str>`, descriptions: map,
-  assignments: `BTreeMap<String, Vec<String>>`) — full snapshot of
-  tool-group assignments. Emitted from the rebuild-queue worker after
-  a `PermChange` / ToolGroups entry commits the JSON file. Same
-  shape as `GET /api/tool-groups`; P3RM1SS10NS tab subscribes.
 - `tombstones_changed` (seq, tombstones: `Vec<TombstoneView>`) —
   full snapshot of destroyed-but-state-kept agents. Emitted on
   destroy, purge, and revive. C0R3 K3PT ST4T3 tab subscribes.
diff --git a/frontend/packages/dashboard/src/core.html b/frontend/packages/dashboard/src/core.html
index 95ac4964..3313df2d 100644
--- a/frontend/packages/dashboard/src/core.html
+++ b/frontend/packages/dashboard/src/core.html
@@ -13,10 +13,9 @@
   <body class="core-shell">
     <!-- C0R3: the host/coordinator surface. Standalone page (served at
        /core.html) carved out of the dashboard's old SYST3M tab so the
-       dashboard tab strip stays lean: kept state (tombstones) and the
-       stale permission entries. Rebuild queue + meta inputs are tabs of
-       /dashboard.html. The section <div> ids (tombstones-section,
-       tombstones-stale-perms) match what core.js's renderers target. Hive
+       dashboard tab strip stays lean: kept state (tombstones). Rebuild
+       queue + meta inputs are tabs of /dashboard.html. The section <div>
+       id (tombstones-section) matches what core.js's renderers target. Hive
        infra containers (`hive-forge`, `hive-gateway`, `hive-matrix`) have
        no dashboard panel — `hivectl stop`/`start`/`restart` is the only
        control surface. -->
@@ -26,11 +25,7 @@
     </header>
 
     <main class="core-main">
-      <!-- tombstones-section shows destroyed agents (purge button).
-         tombstones-stale-perms shows agents with explicit capability/
-         tool-group entries but no live container (typically renamed/deleted
-         agents whose JSON entries persisted). Each stale entry gets a
-         "✕ clear perms" button. -->
+      <!-- tombstones-section shows destroyed agents (purge button). -->
       <p class="meta">
         kept state from previously tombstoned agents — recreating an agent with
         the same name reuses it.
@@ -38,7 +33,6 @@
       <div id="tombstones-section">
         <p class="meta">loading…</p>
       </div>
-      <div id="tombstones-stale-perms"></div>
     </main>
 
     <script type="module" src="/static/core.js" defer></script>
diff --git a/frontend/packages/dashboard/src/core.js b/frontend/packages/dashboard/src/core.js
index 1e8919c1..ebc5a9ca 100644
--- a/frontend/packages/dashboard/src/core.js
+++ b/frontend/packages/dashboard/src/core.js
@@ -1,6 +1,6 @@
 // C0R3 page entry (/core.html). The host/coordinator surface, its own
 // standalone page so the dashboard tab strip stays lean: kept state
-// (tombstones) and the stale permission entries.
+// (tombstones).
 //
 // Rebuild queue + meta inputs are tabs of /dashboard.html, not here. This
 // page is its own esbuild bundle with its own runtime: it cold-loads
@@ -10,7 +10,7 @@
 
 import { $, form, openStream, initServerWarnings } from "./common.js";
 import { el } from "@hive/shared/dom.js";
-import { asyncBtn, bindAsyncForms } from "@hive/shared/forms.js";
+import { bindAsyncForms } from "@hive/shared/forms.js";
 
 // ─── derived state (own copies; this bundle has its own runtime) ──────────
 let tombstonesState = [];
@@ -95,92 +95,6 @@ function renderTombstones(s) {
   root.append(ul);
 }
 
-// ─── stale permission entries (K3PT ST4T3 pane sub-section) ──────────────
-// Agents with explicit capability / tool-group JSON entries but no live
-// container AND no kept-state tombstone (e.g. renamed agents like the old
-// "root" manager name). Ghost detection is server-side via
-// GET /api/permissions/stale so the client doesn't need to maintain a
-// container-roster cache or perform set arithmetic. Lazy-loaded on first
-// "kept" tab activation; refreshed when perm data changes via SSE.
-let stalePermsLoaded = false;
-
-function renderStalePerms(root, ghosts) {
-  root.replaceChildren();
-  if (!ghosts.length) return;
-  root.append(
-    el("p", { class: "tombstones-stale-heading" }, "stale permission entries"),
-  );
-  root.append(
-    el(
-      "p",
-      { class: "meta" },
-      "agents with explicit capability or tool-group entries but no live container " +
-        "or kept state (typically renamed or manually-deleted agents whose JSON entries persisted).",
-    ),
-  );
-  const errP = el("p", { class: "tombstones-stale-err", hidden: true });
-  const ul = el("ul", { class: "tombstones-stale-list" });
-  for (const name of ghosts) {
-    const li = el("li", { class: "tombstones-stale-row" });
-    li.append(el("span", { class: "tombstones-stale-name" }, name));
-    li.append(el("span", { class: "hive-pill-sm badge-muted" }, "stale perms"));
-    const btn = el(
-      "button",
-      {
-        type: "button",
-        class: "btn btn-destroy",
-        title: "remove explicit capability and tool-group entries for " + name,
-      },
-      "✕ clear perms",
-    );
-    btn.addEventListener("click", () =>
-      asyncBtn(btn, async () => {
-        errP.hidden = true;
-        try {
-          const resp = await fetch(
-            "/api/permissions/" + encodeURIComponent(name),
-            { method: "DELETE" },
-          );
-          if (!resp.ok) {
-            const msg = await resp.text().catch(() => String(resp.status));
-            errP.textContent = "failed to clear perms for " + name + ": " + msg;
-            errP.hidden = false;
-            return;
-          }
-          await fetchAndRenderStalePerms();
-        } catch (err) {
-          errP.textContent = "failed to clear perms for " + name + ": " + err;
-          errP.hidden = false;
-        }
-      }),
-    );
-    li.append(btn);
-    ul.append(li);
-  }
-  root.append(ul, errP);
-}
-
-// Ghost detection is entirely server-side: GET /api/permissions/stale
-// returns the computed list of agent names that have explicit JSON entries
-// but are absent from both the live roster and the kept-state tombstones.
-// One call, no client-side roster cache, always authoritative.
-async function fetchAndRenderStalePerms() {
-  const root = $("tombstones-stale-perms");
-  if (!root) return;
-  try {
-    const resp = await fetch("/api/permissions/stale");
-    if (!resp.ok) throw new Error("http " + resp.status);
-    const data = await resp.json();
-    renderStalePerms(root, data.stale || []);
-  } catch (err) {
-    root.replaceChildren();
-    root.append(
-      el("p", { class: "meta" }, "failed to load stale perm data: " + err),
-    );
-  }
-  stalePermsLoaded = true;
-}
-
 // ─── render-all (cold load + any full re-render) ──────────────────────────
 function renderAll() {
   renderTombstones({ tombstones: tombstonesState });
@@ -192,14 +106,6 @@ const SSE_HANDLERS = {
     tombstonesState = (ev.tombstones || []).slice();
     renderTombstones({ tombstones: tombstonesState });
   },
-  // Refresh the stale-perms sub-section when perm data changes (a ghost
-  // was cleared, or perms were saved for an agent whose name collides).
-  capabilities_changed(_ev) {
-    if (stalePermsLoaded) fetchAndRenderStalePerms();
-  },
-  tool_groups_changed(_ev) {
-    if (stalePermsLoaded) fetchAndRenderStalePerms();
-  },
 };
 
 // ─── boot ─────────────────────────────────────────────────────────────────
@@ -226,17 +132,13 @@ async function init() {
   bindAsyncForms(() => refreshState());
 
   await refreshState();
-  fetchAndRenderStalePerms();
 
-  // kinds= matches SSE_HANDLERS below verbatim — narrows this from all
-  // 13 wire kinds down to the 3 this page acts on. This page was one
+  // kinds= matches SSE_HANDLERS below verbatim — narrows the stream down
+  // to the kinds this page acts on. This page was one
   // of 4 unfiltered `/api/dashboard/stream` subscribers before this
   // (subscription discipline, part 1 of the dashboard-event-stream-
   // split issue).
-  const es = openStream(
-    "/api/dashboard/stream?kinds=tombstones_changed," +
-      "capabilities_changed,tool_groups_changed",
-  );
+  const es = openStream("/api/dashboard/stream?kinds=tombstones_changed");
   if (es) {
     es.onmessage = (e) => {
       let ev;
diff --git a/frontend/packages/dashboard/src/dashboard.css b/frontend/packages/dashboard/src/dashboard.css
index c1ecf3c6..1f477956 100644
--- a/frontend/packages/dashboard/src/dashboard.css
+++ b/frontend/packages/dashboard/src/dashboard.css
@@ -566,155 +566,6 @@ footer .banner-thin {
   margin-bottom: 0.8em;
 }
 
-/* ─── capabilities (permissions) table ─────────────────────────────
-   Agents × capabilities matrix in the P3RM1SS10NS tab. Same layout
-   as the tool-groups table below. Horizontally scrollable on narrow
-   viewports. */
-.cap-table-wrap {
-  overflow-x: auto;
-  margin-top: 0.5em;
-}
-.cap-table {
-  border-collapse: collapse;
-  font-size: 0.82em;
-  min-width: 100%;
-}
-.cap-table th,
-.cap-table td {
-  padding: 0.35em 0.6em;
-  border: 1px solid var(--border);
-  text-align: center;
-  vertical-align: middle;
-}
-.cap-table thead th {
-  background: var(--bg-elev);
-  color: var(--muted);
-  letter-spacing: 0.05em;
-  white-space: nowrap;
-}
-.cap-agent-col {
-  text-align: left !important;
-  min-width: 8em;
-}
-.cap-col {
-  min-width: 5em;
-}
-.cap-agent-name {
-  color: var(--fg);
-  font-weight: 600;
-}
-.cap-cb {
-  cursor: pointer;
-  width: 1em;
-  height: 1em;
-  accent-color: var(--purple);
-}
-.cap-row:hover td {
-  background: var(--bg-elev);
-}
-
-/* ─── tool-groups (permissions) table ──────────────────────────────
-   Agents × tool-groups matrix in the P3RM1SS10NS tab. Same layout
-   as the capabilities table above. Horizontally scrollable on narrow
-   viewports. */
-.tg-table-wrap {
-  overflow-x: auto;
-  margin-top: 0.5em;
-}
-.tg-table {
-  border-collapse: collapse;
-  font-size: 0.82em;
-  min-width: 100%;
-}
-.tg-table th,
-.tg-table td {
-  padding: 0.35em 0.6em;
-  border: 1px solid var(--border);
-  text-align: center;
-  vertical-align: middle;
-}
-.tg-table thead th {
-  background: var(--bg-elev);
-  color: var(--muted);
-  letter-spacing: 0.05em;
-  white-space: nowrap;
-}
-.tg-agent-col {
-  text-align: left !important;
-  min-width: 8em;
-}
-.tg-group-col {
-  min-width: 5em;
-}
-.tg-agent-name {
-  color: var(--fg);
-  font-weight: 600;
-}
-.tg-cb {
-  cursor: pointer;
-  width: 1em;
-  height: 1em;
-  accent-color: var(--purple);
-}
-.tg-row:hover td {
-  background: var(--bg-elev);
-}
-
-/* ─── permissions save bar (save-all) ──────────────────────────────
-   One page-level save button for the whole P3RM1SS10NS tab. Sticks to
-   the bottom of the pane so it stays reachable while scrolling a long
-   agent×perm matrix. Disabled (dim) until an edit makes the page dirty;
-   the (N agents) count in the label reflects how many agents will
-   rebuild. `#perm-save-note` carries the transient rebuilding/error
-   line beside it. */
-.perm-save-bar {
-  position: sticky;
-  bottom: 0;
-  display: flex;
-  align-items: center;
-  gap: 0.8em;
-  margin-top: 1em;
-  padding: 0.7em 0;
-  background: var(--bg);
-  border-top: 1px solid var(--border);
-}
-.perm-save-bar .btn:disabled {
-  opacity: 0.45;
-  cursor: not-allowed;
-}
-.perm-save-err {
-  color: var(--red);
-}
-
-/* Stale permission entry (agent not in the live roster) */
-.perm-row-stale td {
-  opacity: 0.7;
-}
-.perm-stale-label {
-  font-size: 0.75em;
-  color: var(--muted);
-  margin-left: 0.4em;
-}
-.perm-remove-btn {
-  margin-left: 0.5em;
-  padding: 0.05em 0.5em;
-  font-size: 0.75em;
-  color: var(--red);
-  background: transparent;
-  border: 1px solid currentColor;
-  border-radius: 3px;
-  cursor: pointer;
-  font-family: inherit;
-  opacity: 0.8;
-}
-.perm-remove-btn:hover {
-  opacity: 1;
-}
-.perm-remove-btn:disabled {
-  opacity: 0.4;
-  cursor: not-allowed;
-}
-
 /* Selection bar — sticky-bottom strip for bulk actions. */
 .selection-bar {
   position: fixed;
diff --git a/frontend/packages/dashboard/src/dashboard.html b/frontend/packages/dashboard/src/dashboard.html
index fb889a80..e02a573c 100644
--- a/frontend/packages/dashboard/src/dashboard.html
+++ b/frontend/packages/dashboard/src/dashboard.html
@@ -71,18 +71,6 @@
         >
           <span class="tab-label">◆ BUILD L0GS ◆</span>
         </a>
-        <!-- P3RM1SS10NS: per-agent capability grants and tool-group
-           assignments. Both tables are fetched on tab activation. -->
-        <a
-          class="tab"
-          id="tab-permissions"
-          href="#permissions"
-          role="tab"
-          aria-controls="tab-pane-permissions"
-          data-tab="permissions"
-        >
-          <span class="tab-label">◆ P3RM1SS10NS ◆</span>
-        </a>
 
         <!-- ST4TS lives on its own page now (`/stats.html`), reached from
            the H0M3 hub — the hive-wide rollup is a standalone read-only
@@ -205,75 +193,6 @@
           <div id="build-list"><p class="meta">loading…</p></div>
         </section>
 
-        <!-- P3RM1SS10NS: per-agent capability grants + tool-group
-         assignments. Both tables are column-driven from the backend
-         (GET /api/capabilities, GET /api/tool-groups) so new entries
-         require no UI change. Edits stage in-browser across both
-         matrices; the single page-level "save all" button POSTs every
-         changed agent to /api/permissions in one atomic batch (caps +
-         groups coalesce into one rebuild per agent). -->
-        <section
-          class="tab-pane"
-          id="tab-pane-permissions"
-          data-tab-pane="permissions"
-          hidden
-          role="tabpanel"
-          aria-labelledby="tab-permissions"
-        >
-          <h2>◆ C4P4B1L1T13S ◆</h2>
-          <div class="divider">
-            ══════════════════════════════════════════════════════════════
-          </div>
-          <p class="meta">
-            per-agent capability grants. capabilities unlock gated MCP tools and
-            system access. toggle any cells across both tables, then hit "save
-            all" at the bottom — each changed agent rebuilds exactly once.
-          </p>
-          <div id="capabilities-section">
-            <p class="meta">loading…</p>
-          </div>
-
-          <!-- T00L GR0UPS: per-agent tool-group permission matrix. Rows = agents,
-           cols = tool groups fetched from GET /api/tool-groups.
-           Checking / unchecking is staged in the UI; the single page-level
-           "save all" button POSTs every changed agent to
-           /api/permissions in one atomic batch, coalescing caps + groups
-           per agent into one rebuild each.
-           Absent agents default to the role default (shown in parens). -->
-          <h2>◆ T00L GR0UPS ◆</h2>
-          <div class="divider">
-            ══════════════════════════════════════════════════════════════
-          </div>
-          <p class="meta">
-            per-agent tool-group permissions. columns are filled from the
-            backend — adding a new group requires no UI change. agents without
-            an explicit entry use the role default (agents: messaging, meta,
-            inbox, execution).
-          </p>
-          <div id="tool-groups-section">
-            <p class="meta">loading…</p>
-          </div>
-
-          <!-- Page-level save bar (save-all issue): one button for the whole
-           permissions page. Staged checkbox edits across BOTH matrices are
-           diffed against their render-time baselines and POSTed together to
-           /api/permissions; caps + groups for one agent coalesce into a
-           single rebuild. Disabled until something is dirty. The atomic
-           batch either fully lands (queued ✓ → rebuilding) or fully fails
-           (error note, nothing applied). -->
-          <div class="perm-save-bar">
-            <button
-              type="button"
-              id="perm-save-all"
-              class="btn btn-approve"
-              disabled
-            >
-              save all
-            </button>
-            <span id="perm-save-note" class="meta"></span>
-          </div>
-        </section>
-
         <!-- ST4TS: hive-wide turn-stats aggregate lives on its own page now
          (`/stats.html`), reached from the H0M3 hub. The markup + the
          hive-stats render JS moved there; when tabs.js boots on the
diff --git a/frontend/packages/dashboard/src/index.html b/frontend/packages/dashboard/src/index.html
index a9fcefff..4e5fd46c 100644
--- a/frontend/packages/dashboard/src/index.html
+++ b/frontend/packages/dashboard/src/index.html
@@ -41,9 +41,7 @@
               <span class="home-tile-icon" aria-hidden="true">🖥</span>
               <span class="home-tile-label">Dashboard</span>
             </span>
-            <span class="home-tile-desc"
-              >containers · builds · permissions</span
-            >
+            <span class="home-tile-desc">containers · builds</span>
           </a>
 
           <a class="home-tile" href="/flow.html">
@@ -69,7 +67,7 @@
               <span class="home-tile-icon" aria-hidden="true">⬡</span>
               <span class="home-tile-label">Core</span>
             </span>
-            <span class="home-tile-desc">kept state · stale permissions</span>
+            <span class="home-tile-desc">kept state</span>
           </a>
 
           <!-- API tile: the OpenAPI spec + Swagger UI are always served by
diff --git a/frontend/packages/dashboard/src/permissions.js b/frontend/packages/dashboard/src/permissions.js
deleted file mode 100644
index e4aa0794..00000000
--- a/frontend/packages/dashboard/src/permissions.js
+++ /dev/null
@@ -1,468 +0,0 @@
-// Dashboard P3RM1SS10NS tab — the per-agent capabilities + tool-groups
-// matrices, with a single page-level "save all" button.
-//
-// Both tables are fetched on tab activation (`GET /api/capabilities`,
-// `GET /api/tool-groups`) and after each save. Columns (caps / groups)
-// come from the backend so the UI needs no change when a new one is
-// added. Live updates arrive via the `capabilities_changed` /
-// `tool_groups_changed` dashboard events (fired after the rebuild-queue
-// worker commits the perm JSON file), wired into the entry's mutation
-// dispatch table.
-//
-// Stateless at module scope: each render builds fresh from the fetched
-// payload. The agent roster (`containersState`) is the only shared state
-// it reads — to union live containers with agents already named in the
-// assignments map.
-//
-// Editing model: checkboxes are diffed against a `data-baseline` captured at
-// render time; only changed perm-types per agent are POSTed to
-// `POST /api/permissions` as `{ changes: [{agent, tool_groups?, capabilities?}] }`.
-// Omitted field = leave untouched; included array = full replace. The backend
-// coalesces caps+groups per agent into ONE queue entry (one rebuild, no
-// double-rebuild). Batch is atomic — saved→rebuilding only fires on a clean 200.
-
-import { $ } from "./common.js";
-import { el } from "@hive/shared/dom.js";
-import { containersState } from "./state.js";
-import { asyncBtn } from "@hive/shared/forms.js";
-
-// ── SSE re-render guards ────────────────────────────────────────────
-// Skip the live re-render when the operator has unsaved edits in that
-// section (or a checkbox focused) — clobbering a half-finished edit set
-// is worse than a brief staleness window. The tab-activation re-fetch
-// and the post-save re-fetch are the recovery paths; both clear dirty.
-
-export function applyCapabilitiesChanged(ev) {
-  const root = $("capabilities-section");
-  if (!root) return;
-  if (root.contains(document.activeElement)) return;
-  if (sectionHasDirty(root)) return;
-  renderCapabilities(root, ev);
-}
-export function applyToolGroupsChanged(ev) {
-  const root = $("tool-groups-section");
-  if (!root) return;
-  if (root.contains(document.activeElement)) return;
-  if (sectionHasDirty(root)) return;
-  renderToolGroups(root, ev);
-}
-
-// A section is dirty if any checkbox diverges from its render-time
-// baseline. Cheap DOM scan; no module-level mirror to drift.
-function sectionHasDirty(root) {
-  for (const cb of root.querySelectorAll("input[type=checkbox]")) {
-    if (cb.checked !== (cb.dataset.baseline === "1")) return true;
-  }
-  return false;
-}
-
-export async function fetchAndRenderCapabilities() {
-  const root = $("capabilities-section");
-  if (!root) return;
-  root.replaceChildren();
-  root.append(el("p", { class: "meta" }, "loading…"));
-  try {
-    const resp = await fetch("/api/capabilities");
-    if (!resp.ok) throw new Error("http " + resp.status);
-    const data = await resp.json();
-    renderCapabilities(root, data);
-  } catch (err) {
-    root.replaceChildren();
-    root.append(el("p", { class: "meta" }, "fetch failed: " + err));
-  }
-}
-
-function renderCapabilities(root, data) {
-  root.replaceChildren();
-  const { caps, descriptions = {}, assignments, effective = {} } = data;
-  if (!caps || !caps.length) {
-    root.append(el("p", { class: "meta" }, "(no capabilities defined)"));
-    updateSaveBar();
-    return;
-  }
-
-  // Agent rows: prefer the backend roster (every manageable agent,
-  // default-perms included). Fall back to the live-container ∪ explicit
-  // union for older payloads that don't carry `agents`.
-  const agentNames =
-    data.agents && data.agents.length
-      ? [...data.agents]
-      : [
-          ...new Set([
-            ...Array.from(containersState.keys()),
-            ...Object.keys(assignments),
-          ]),
-        ].sort();
-
-  if (!agentNames.length) {
-    root.append(el("p", { class: "meta" }, "(no agents)"));
-    updateSaveBar();
-    return;
-  }
-
-  const wrap = el("div", { class: "cap-table-wrap" });
-  const table = el("table", { class: "cap-table" });
-
-  // Header row.
-  const thead = el("thead");
-  const hrow = el("tr");
-  hrow.append(el("th", { class: "cap-agent-col" }, "agent"));
-  for (const c of caps) {
-    hrow.append(el("th", { class: "cap-col", title: descriptions[c] || c }, c));
-  }
-  thead.append(hrow);
-  table.append(thead);
-
-  const tbody = el("tbody");
-  for (const name of agentNames) {
-    // Effective caps (explicit-or-default) drive the checkboxes so
-    // default-perms agents show their real grants, not blank.
-    const assigned = effective[name] || assignments[name] || [];
-    // `containersState` is keyed from `nixos-container list`, which
-    // includes stopped-but-configured containers — so a temporarily-stopped
-    // agent is NOT stale. Only destroyed/renamed agents are absent here.
-    const isStale = !containersState.has(name);
-    const tr = el("tr", {
-      class: "cap-row" + (isStale ? " perm-row-stale" : ""),
-      "data-agent": name,
-    });
-
-    // Agent name cell.
-    const nameTd = el("td", { class: "cap-agent-col" });
-    nameTd.append(el("span", { class: "cap-agent-name" }, name));
-    if (isStale) {
-      nameTd.append(el("span", { class: "perm-stale-label" }, "(not running)"));
-      const removeBtn = el(
-        "button",
-        {
-          type: "button",
-          class: "perm-remove-btn",
-          title: "remove stale permission entries for " + name,
-        },
-        "✕ remove",
-      );
-      removeBtn.addEventListener("click", () => clearStaleAgent(name, root));
-      nameTd.append(removeBtn);
-    }
-    tr.append(nameTd);
-
-    // One checkbox per capability.
-    for (const c of caps) {
-      const checked = assigned.includes(c);
-      const td = el("td", { class: "cap-col" });
-      const cb = el("input", {
-        type: "checkbox",
-        class: "cap-cb",
-        "data-cap": c,
-        "data-baseline": checked ? "1" : "0",
-        "aria-label": c,
-      });
-      cb.checked = checked;
-      cb.addEventListener("change", onCellToggle);
-      td.append(cb);
-      tr.append(td);
-    }
-
-    tbody.append(tr);
-  }
-  table.append(tbody);
-  wrap.append(table);
-  root.append(wrap);
-  updateSaveBar();
-}
-
-export async function fetchAndRenderToolGroups() {
-  const root = $("tool-groups-section");
-  if (!root) return;
-  root.replaceChildren();
-  root.append(el("p", { class: "meta" }, "loading…"));
-  try {
-    const resp = await fetch("/api/tool-groups");
-    if (!resp.ok) throw new Error("http " + resp.status);
-    const data = await resp.json();
-    renderToolGroups(root, data);
-  } catch (err) {
-    root.replaceChildren();
-    root.append(el("p", { class: "meta" }, "fetch failed: " + err));
-  }
-}
-
-function renderToolGroups(root, data) {
-  root.replaceChildren();
-  const { groups, descriptions = {}, assignments, effective = {} } = data;
-  if (!groups || !groups.length) {
-    root.append(el("p", { class: "meta" }, "(no tool groups defined)"));
-    updateSaveBar();
-    return;
-  }
-
-  // Agent rows: prefer the backend roster (default-perms agents included);
-  // fall back to the live-container ∪ explicit union for older payloads.
-  const agentNames =
-    data.agents && data.agents.length
-      ? [...data.agents]
-      : [
-          ...new Set([
-            ...Array.from(containersState.keys()),
-            ...Object.keys(assignments),
-          ]),
-        ].sort();
-
-  if (!agentNames.length) {
-    root.append(el("p", { class: "meta" }, "(no agents)"));
-    updateSaveBar();
-    return;
-  }
-
-  const wrap = el("div", { class: "tg-table-wrap" });
-  const table = el("table", { class: "tg-table" });
-
-  // Header row.
-  const thead = el("thead");
-  const hrow = el("tr");
-  hrow.append(el("th", { class: "tg-agent-col" }, "agent"));
-  for (const g of groups) {
-    hrow.append(
-      el("th", { class: "tg-group-col", title: descriptions[g] || g }, g),
-    );
-  }
-  thead.append(hrow);
-  table.append(thead);
-
-  const tbody = el("tbody");
-  for (const name of agentNames) {
-    // Effective groups (explicit-or-role-default) drive the checkboxes so
-    // a default agent shows its real groups, not blank — and saving keeps
-    // them instead of silently stripping the defaults. The "(default)"
-    // badge still keys off explicit-assignment presence.
-    const assigned = effective[name] || assignments[name] || [];
-    const hasExplicit = Object.prototype.hasOwnProperty.call(assignments, name);
-    // `containersState` is keyed from `nixos-container list`, which
-    // includes stopped-but-configured containers — only destroyed/renamed
-    // agents are absent.
-    const isStale = !containersState.has(name);
-    const tr = el("tr", {
-      class: "tg-row" + (isStale ? " perm-row-stale" : ""),
-      "data-agent": name,
-    });
-
-    // Agent name cell.
-    const nameTd = el("td", { class: "tg-agent-col" });
-    nameTd.append(el("span", { class: "tg-agent-name" }, name));
-    if (isStale) {
-      nameTd.append(el("span", { class: "perm-stale-label" }, "(not running)"));
-      const removeBtn = el(
-        "button",
-        {
-          type: "button",
-          class: "perm-remove-btn",
-          title: "remove stale permission entries for " + name,
-        },
-        "✕ remove",
-      );
-      removeBtn.addEventListener("click", () => clearStaleAgent(name, root));
-      nameTd.append(removeBtn);
-    } else if (!hasExplicit) {
-      nameTd.append(
-        el("span", { class: "meta tg-default-label" }, "(default)"),
-      );
-    }
-    tr.append(nameTd);
-
-    // One checkbox per group.
-    for (const g of groups) {
-      const checked = assigned.includes(g);
-      const td = el("td", { class: "tg-group-col" });
-      const cb = el("input", {
-        type: "checkbox",
-        class: "tg-cb",
-        "data-group": g,
-        "data-baseline": checked ? "1" : "0",
-        "aria-label": g,
-      });
-      cb.checked = checked;
-      cb.addEventListener("change", onCellToggle);
-      td.append(cb);
-      tr.append(td);
-    }
-
-    tbody.append(tr);
-  }
-  table.append(tbody);
-  wrap.append(table);
-  root.append(wrap);
-  updateSaveBar();
-}
-
-// ── Save-all wiring ─────────────────────────────────────────────────
-
-// Recompute the save bar on every cell toggle. Also clears any stale
-// error/✓ status the bar may be showing from a prior save.
-function onCellToggle() {
-  clearSaveStatus();
-  updateSaveBar();
-}
-
-// Collect the sparse change-set: one entry per agent that has at least
-// one perm-type diverging from baseline. Only the changed perm-type(s)
-// are included so untouched defaults stay defaults (an included array is
-// a full replacement → omitting it leaves that file alone).
-function collectChanges() {
-  const byAgent = new Map(); // agent -> { capabilities?, tool_groups? }
-  collectSection(
-    $("capabilities-section"),
-    ".cap-row",
-    ".cap-cb",
-    "cap",
-    "capabilities",
-    byAgent,
-  );
-  collectSection(
-    $("tool-groups-section"),
-    ".tg-row",
-    ".tg-cb",
-    "group",
-    "tool_groups",
-    byAgent,
-  );
-  const changes = [];
-  for (const [agent, obj] of byAgent) changes.push({ agent, ...obj });
-  return changes;
-}
-
-function collectSection(root, rowSel, cbSel, dataKey, field, byAgent) {
-  if (!root) return;
-  for (const tr of root.querySelectorAll(rowSel)) {
-    const agent = tr.dataset.agent;
-    if (!agent) continue;
-    let dirty = false;
-    const selected = [];
-    for (const cb of tr.querySelectorAll(cbSel)) {
-      if (cb.checked !== (cb.dataset.baseline === "1")) dirty = true;
-      if (cb.checked) selected.push(cb.dataset[dataKey]);
-    }
-    if (dirty) {
-      const obj = byAgent.get(agent) || {};
-      obj[field] = selected;
-      byAgent.set(agent, obj);
-    }
-  }
-}
-
-function updateSaveBar() {
-  const btn = $("perm-save-all");
-  if (!btn) return;
-  // Don't stomp a transient saving/rebuilding label.
-  if (btn.dataset.busy === "1") return;
-  const n = collectChanges().length;
-  btn.disabled = n === 0;
-  btn.textContent =
-    n === 0 ? "save all" : `save all (${n} agent${n === 1 ? "" : "s"})`;
-}
-
-// Remove all explicit permission entries for a stale (non-running)
-// agent. Calls DELETE /api/permissions/{agent}, which bypasses the
-// roster guard so the stale entries can be cleaned up even though the
-// agent isn't in the live container list. Re-fetches both tables after
-// the delete so the row disappears immediately.
-async function clearStaleAgent(name, sectionRoot) {
-  const btn = sectionRoot
-    ? sectionRoot.querySelector(
-        `[data-agent="${CSS.escape(name)}"] .perm-remove-btn`,
-      )
-    : null;
-  const doDelete = async () => {
-    try {
-      const resp = await fetch("/api/permissions/" + encodeURIComponent(name), {
-        method: "DELETE",
-      });
-      if (!resp.ok) {
-        const text = await resp.text().catch(() => resp.status);
-        setSaveNote("failed to remove " + name + ": " + text, true);
-        return;
-      }
-      // Re-fetch both sections so the stale row disappears.
-      await Promise.all([
-        fetchAndRenderCapabilities(),
-        fetchAndRenderToolGroups(),
-      ]);
-    } catch (err) {
-      setSaveNote("failed to remove " + name + ": " + err, true);
-    }
-  };
-  // asyncBtn guards double-submit; fall through without guard when there
-  // is no button (e.g. called programmatically without a DOM context).
-  // Return the promise so callers can await clearStaleAgent() if needed.
-  if (btn) return asyncBtn(btn, doDelete);
-  await doDelete();
-}
-
-function clearSaveStatus() {
-  const note = $("perm-save-note");
-  if (note) {
-    note.textContent = "";
-    note.classList.remove("perm-save-err");
-  }
-}
-
-function setSaveNote(text, isErr) {
-  const note = $("perm-save-note");
-  if (!note) return;
-  note.textContent = text;
-  note.classList.toggle("perm-save-err", !!isErr);
-}
-
-async function saveAll() {
-  const btn = $("perm-save-all");
-  if (!btn) return;
-  const changes = collectChanges();
-  if (!changes.length) return;
-  btn.dataset.busy = "1";
-  btn.disabled = true;
-  btn.textContent = "saving…";
-  clearSaveStatus();
-  try {
-    const r = await fetch("/api/permissions", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ changes }),
-    });
-    if (!r.ok) {
-      const txt = await r.text();
-      btn.dataset.busy = "";
-      btn.disabled = false;
-      btn.textContent = "save all";
-      setSaveNote("save failed: " + (txt || "http " + r.status), true);
-      updateSaveBar();
-      return;
-    }
-    // Atomic 200: the whole batch landed. Show a rebuilding hint and
-    // re-fetch both tables once the queue worker has committed — that
-    // resets baselines (dirty clears) and the bar disables itself.
-    const n = changes.length;
-    btn.textContent = "queued ✓";
-    setSaveNote(`rebuilding ${n} agent${n === 1 ? "" : "s"}…`, false);
-    setTimeout(() => {
-      btn.dataset.busy = "";
-      fetchAndRenderCapabilities();
-      fetchAndRenderToolGroups();
-    }, 900);
-  } catch (err) {
-    btn.dataset.busy = "";
-    btn.disabled = false;
-    btn.textContent = "save all";
-    setSaveNote("save failed: " + String(err), true);
-    updateSaveBar();
-  }
-}
-
-// Bind the page-level save button once. Called from the dashboard entry
-// after the DOM is ready (the button lives in the static permissions
-// pane markup, so it exists before any fetch).
-export function initPermissions() {
-  const btn = $("perm-save-all");
-  if (btn && !btn.dataset.bound) {
-    btn.dataset.bound = "1";
-    btn.addEventListener("click", saveAll);
-  }
-}
diff --git a/frontend/packages/dashboard/src/state.js b/frontend/packages/dashboard/src/state.js
index 0b3b7a9e..84076efe 100644
--- a/frontend/packages/dashboard/src/state.js
+++ b/frontend/packages/dashboard/src/state.js
@@ -1,8 +1,8 @@
 // Shared dashboard state — the one piece of cross-domain state in the
 // dashboard SPA: the live agent roster.
 //
-// The roster is read by nearly every tab (the container tree, the
-// capabilities + tool-group matrices, and the selection bar), so
+// The roster is read by nearly every tab (the container tree and the
+// selection bar), so
 // it lives here as a single source of truth that each domain module
 // imports rather than threading through call signatures. Everything
 // else in the dashboard is domain-local and lives with its own module.
diff --git a/frontend/packages/dashboard/src/system-sections.css b/frontend/packages/dashboard/src/system-sections.css
index 1f862cab..ae046ab2 100644
--- a/frontend/packages/dashboard/src/system-sections.css
+++ b/frontend/packages/dashboard/src/system-sections.css
@@ -199,42 +199,3 @@
 /* Remove the now-dead `.rqe-step` rule (the `step` sub-step label was
    retired from the wire in `feat(job_queue): retire the now-off-wire step
    sub-step label` — the rule has had no JS referents since then). */
-
-/* ─── K3PT ST4T3 › stale permission entries sub-section ────────────────────
-   Agents with explicit capability / tool-group entries in the JSON but no
-   live container (renamed or manually-deleted agents). Lazy-loaded on tab
-   activation, refreshed on capabilities_changed / tool_groups_changed. */
-.tombstones-stale-heading {
-  margin: 1.2em 0 0.3em;
-  color: var(--muted);
-  font-size: 0.8em;
-  text-transform: uppercase;
-  letter-spacing: 0.08em;
-  border-top: 1px solid var(--border);
-  padding-top: 0.8em;
-}
-.tombstones-stale-list {
-  list-style: none;
-  padding: 0;
-  margin: 0;
-  display: grid;
-  gap: 0.3em;
-}
-.tombstones-stale-row {
-  display: flex;
-  align-items: center;
-  gap: 0.5em;
-  padding: 0.35em 0.6em;
-  border: 1px dashed var(--border);
-  background: color-mix(in srgb, var(--bg-elev) 35%, transparent);
-}
-.tombstones-stale-name {
-  color: var(--muted);
-  font-weight: bold;
-  font-size: 0.9em;
-}
-.tombstones-stale-err {
-  margin-top: 0.4em;
-  color: var(--red);
-  font-size: 0.85em;
-}
diff --git a/frontend/packages/dashboard/src/tabs.js b/frontend/packages/dashboard/src/tabs.js
index adef8516..4e2865da 100644
--- a/frontend/packages/dashboard/src/tabs.js
+++ b/frontend/packages/dashboard/src/tabs.js
@@ -16,13 +16,6 @@ import { el } from "@hive/shared/dom.js";
 import { bindAsyncForms } from "@hive/shared/forms.js";
 import { createTabStrip } from "@hive/shared/tabs.js";
 import { containersState, syncContainersFromSnapshot } from "./state.js";
-import {
-  applyCapabilitiesChanged,
-  applyToolGroupsChanged,
-  fetchAndRenderCapabilities,
-  fetchAndRenderToolGroups,
-  initPermissions,
-} from "./permissions.js";
 import {
   initJobqRollup,
   syncTransientsFromSnapshot,
@@ -61,12 +54,7 @@ window.marked = marked;
   // Sections whose innerHTML gets blown away on each refresh. If the
   // operator is typing in one of them, skip the refresh — the next
   // tick (or a manual action) will pick it up after they blur.
-  const MANAGED_SECTION_IDS = [
-    "containers-section",
-    "inbox-section",
-    "capabilities-section",
-    "tool-groups-section",
-  ];
+  const MANAGED_SECTION_IDS = ["containers-section", "inbox-section"];
   // <details> sections that should survive a refresh need a stable
   // `data-restore-key` attribute. snapshotOpenDetails walks managed
   // sections and records which keys are currently open; restoreOpenDetails
@@ -210,8 +198,6 @@ window.marked = marked;
     },
     meta_inputs_changed: onMetaInputsChanged,
     meta_update_running: onMetaUpdateRunning,
-    capabilities_changed: applyCapabilitiesChanged,
-    tool_groups_changed: applyToolGroupsChanged,
   };
   (function bindDashboardStream() {
     // Route through the SharedWorker so all open hyperhive tabs on the
@@ -222,13 +208,12 @@ window.marked = marked;
     // fallback when SharedWorker isn't supported.
     //
     // kinds= matches MUTATION_HANDLERS verbatim, so the stream carries
-    // only the 9 wire kinds this page acts on.
+    // only the 7 wire kinds this page acts on.
     const es = openStream(
       "/api/dashboard/stream?kinds=" +
         "transient_set,transient_cleared," +
         "container_state_changed,container_removed,rebuild_queue_changed," +
-        "meta_inputs_changed,meta_update_running," +
-        "capabilities_changed,tool_groups_changed",
+        "meta_inputs_changed,meta_update_running",
     );
     es.onmessage = (e) => {
       let ev;
@@ -260,8 +245,8 @@ window.marked = marked;
   })();
 
   // ─── tab routing ───────────────────────────────────────────────────────
-  // Hash-based: `#agents` / `#rebuild` / `#meta` / `#buildlogs` /
-  // `#permissions` activate the matching pane on the dashboard. Empty
+  // Hash-based: `#agents` / `#rebuild` / `#meta` / `#buildlogs`
+  // activate the matching pane on the dashboard. Empty
   // hash defaults to 4G3NTS. FL0W and ST4TS are NOT tabs —
   // they're separate pages (`/flow.html`, `/stats.html`) reached from
   // the H0M3 hub. Tab routing only
@@ -278,15 +263,6 @@ window.marked = marked;
     // visibility (bar only belongs on 4G3NTS where agent cards live).
     document.body.dataset.activeTab = target;
     renderSelectionBar(Array.from(containersState.values()));
-    // Permissions tables: SSE covers worker-applied changes
-    // (capabilities_changed / tool_groups_changed); re-fetch on
-    // activation as a safety net for any gap between SSE events and
-    // the cold-load snapshot.
-    if (target === "permissions") {
-      initPermissions();
-      fetchAndRenderCapabilities();
-      fetchAndRenderToolGroups();
-    }
     onBuildsTabShown(target);
   }
 
diff --git a/frontend/packages/swarm-ui/src/pages/CreateAgentForm.tsx b/frontend/packages/swarm-ui/src/pages/CreateAgentForm.tsx
index e7b2f0ca..c001988e 100644
--- a/frontend/packages/swarm-ui/src/pages/CreateAgentForm.tsx
+++ b/frontend/packages/swarm-ui/src/pages/CreateAgentForm.tsx
@@ -25,6 +25,9 @@
 // Its name field, hive select, and submit button all come from the
 // shared `ui/` form kit (`TextField`/`SelectField`/`Button`) rather than
 // page-scoped input/button chrome — see that kit's own comments for why.
+//
+// Permissions: checkboxes from `GET /api/permissions`, on the default set;
+// sent only when changed, so an untouched agent follows the default.
 import { useEffect, useState } from "preact/hooks";
 import { Link } from "wouter-preact";
 import { ApiErrorPanel } from "@hive/shared/api-error-panel.js";
@@ -44,6 +47,12 @@ import {
   InferenceFields,
   type InferenceDraft,
 } from "../agent/detail/AgentInference.js";
+import { FormField } from "../ui/form-field/FormField.js";
+import { MultiselectFilterOptions } from "../ui/multiselect-filter/MultiselectFilter.js";
+import {
+  requestPermissions,
+  togglePermission,
+} from "./CreateAgentPermissions.js";
 import "./CreateAgentForm.css";
 
 // Mirrors swarm-controller's `HiveEntry` — same shape `HivesPage`
@@ -59,6 +68,12 @@ interface CreateAgentResponse {
   node_id: number;
 }
 
+// Mirrors swarm-controller's `Catalogue` (`GET /api/permissions`).
+interface PermissionCatalogue {
+  all: string[];
+  default: string[];
+}
+
 type SubmitState =
   | { status: "idle" }
   | { status: "submitting" }
@@ -103,6 +118,12 @@ export function CreateAgentForm({
     EMPTY_INFERENCE_DRAFT,
   );
   const inferenceProblem = draftProblem(inference);
+  // `null` until `/api/permissions` answers; `selected` starts on its default.
+  const [catalogue, setCatalogue] = useState<PermissionCatalogue | null>(null);
+  const [catalogueError, setCatalogueError] = useState<ProblemDetails | null>(
+    null,
+  );
+  const [selected, setSelected] = useState<string[]>([]);
 
   // Loaded once, not re-fetched on submit: the roster changes rarely
   // enough (a nix-level swarm config change) that staleness within one
@@ -124,6 +145,19 @@ export function CreateAgentForm({
     })().catch((e: unknown) => setHivesError({ detail: String(e) }));
   }, []);
 
+  useEffect(() => {
+    (async () => {
+      const r = await fetch("/api/permissions");
+      if (!r.ok) {
+        setCatalogueError(await readApiError(r));
+        return;
+      }
+      const data = (await r.json()) as PermissionCatalogue;
+      setCatalogue(data);
+      setSelected(data.default);
+    })().catch((e: unknown) => setCatalogueError({ detail: String(e) }));
+  }, []);
+
   const hiveOptions: SelectOption[] = (hives ?? []).map((h) => ({
     value: h.name,
     label: h.name,
@@ -146,6 +180,9 @@ export function CreateAgentForm({
           hive,
           ...(Object.keys(limits).length > 0 ? { limits } : {}),
           ...(Object.keys(settings).length > 0 ? { inference: settings } : {}),
+          permissions: catalogue
+            ? requestPermissions(selected, catalogue.default)
+            : undefined,
         }),
       });
       if (!r.ok) {
@@ -155,6 +192,7 @@ export function CreateAgentForm({
       const data = (await r.json()) as CreateAgentResponse;
       setResult({ status: "done", nodeId: data.node_id });
       setName("");
+      if (catalogue) setSelected(catalogue.default);
     } catch (err) {
       setResult({ status: "error", problem: { detail: String(err) } });
     }
@@ -176,6 +214,12 @@ export function CreateAgentForm({
               problem={hivesError}
             />
           )}
+          {catalogueError && (
+            <ApiErrorPanel
+              context="failed to load the permission list"
+              problem={catalogueError}
+            />
+          )}
           <form class="create-agent-form" onSubmit={submit}>
             <TextField
               id="agent-name"
@@ -202,6 +246,19 @@ export function CreateAgentForm({
                     : "select a hive"
               }
             />
+            <FormField label="permissions" htmlFor="agent-permissions">
+              <div id="agent-permissions">
+                {catalogue ? (
+                  <MultiselectFilterOptions
+                    options={catalogue.all}
+                    filter={{ values: selected, negate: false }}
+                    onToggle={(v) => setSelected((s) => togglePermission(s, v))}
+                  />
+                ) : (
+                  <span>loading…</span>
+                )}
+              </div>
+            </FormField>
             <details class="create-agent-section">
               <summary>resource caps</summary>
               <div class="create-agent-section-body">
@@ -230,6 +287,7 @@ export function CreateAgentForm({
               disabled={
                 result.status === "submitting" ||
                 !hivesReady ||
+                !catalogue ||
                 inferenceProblem !== null
               }
             >
diff --git a/frontend/packages/swarm-ui/src/pages/CreateAgentPermissions.ts b/frontend/packages/swarm-ui/src/pages/CreateAgentPermissions.ts
new file mode 100644
index 00000000..6e641600
--- /dev/null
+++ b/frontend/packages/swarm-ui/src/pages/CreateAgentPermissions.ts
@@ -0,0 +1,24 @@
+// The create-agent form's permissions logic, kept out of the component so
+// `npm test` can run it.
+
+/** `selected` with `value` added, or removed when it is there. */
+export function togglePermission(selected: string[], value: string): string[] {
+  return selected.includes(value)
+    ? selected.filter((p) => p !== value)
+    : [...selected, value];
+}
+
+/**
+ * The `permissions` to send with a create: `undefined` while `selected` is
+ * the default set (in any order), so the agent's key stays unset and follows
+ * the default; otherwise the list, which may be empty.
+ */
+export function requestPermissions(
+  selected: string[],
+  defaults: string[],
+): string[] | undefined {
+  const same =
+    selected.length === defaults.length &&
+    selected.every((p) => defaults.includes(p));
+  return same ? undefined : selected;
+}
diff --git a/frontend/packages/swarm-ui/test/create-agent-permissions.test.mjs b/frontend/packages/swarm-ui/test/create-agent-permissions.test.mjs
new file mode 100644
index 00000000..4fb28e2b
--- /dev/null
+++ b/frontend/packages/swarm-ui/test/create-agent-permissions.test.mjs
@@ -0,0 +1,31 @@
+// The create-agent form's permissions field: what a toggle does and what the
+// create request carries. Run by `npm test` with Node's type stripping.
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  requestPermissions,
+  togglePermission,
+} from "../src/pages/CreateAgentPermissions.ts";
+
+const defaults = ["messaging", "meta", "inbox", "execution"];
+
+test("a toggle adds a missing permission and removes a present one", () => {
+  assert.deepEqual(togglePermission(["meta"], "inbox"), ["meta", "inbox"]);
+  assert.deepEqual(togglePermission(["meta", "inbox"], "meta"), ["inbox"]);
+});
+
+test("the default set, in any order, sends no permissions", () => {
+  assert.equal(
+    requestPermissions([...defaults].reverse(), defaults),
+    undefined,
+  );
+});
+
+test("a changed set is sent, an empty one included", () => {
+  assert.deepEqual(requestPermissions(["messaging"], defaults), ["messaging"]);
+  assert.deepEqual(requestPermissions([], defaults), []);
+  assert.deepEqual(requestPermissions([...defaults, "web_tools"], defaults), [
+    ...defaults,
+    "web_tools",
+  ]);
+});
diff --git a/hive-agent-mcp/src/mcp/mod.rs b/hive-agent-mcp/src/mcp/mod.rs
index 166fd0c5..d3fc036c 100644
--- a/hive-agent-mcp/src/mcp/mod.rs
+++ b/hive-agent-mcp/src/mcp/mod.rs
@@ -11,7 +11,7 @@
 //!
 //! One `AgentServer { socket }` struct for all roles.
 //! Tool access is gated upstream by `--allowedTools` (derived from the
-//! agent's `ToolGroup` config); the server itself is a dumb dispatcher.
+//! agent's `Permission` set); the server itself is a dumb dispatcher.
 //! All tools go through the same `run_tool_envelope` helper.
 
 use std::future::Future;
@@ -135,7 +135,7 @@ impl AgentServer {
 }
 
 // IMPORTANT: when adding a new `#[tool]` fn to this impl, also add
-// its name to the matching `ToolGroup::tools()` slice in hive-sh4re.
+// its name to the matching `Permission::tools()` slice in hive-sh4re.
 // Claude Code's permission gate refuses uninlisted MCP tools in
 // non-interactive `--print` mode with "permissions not granted yet".
 #[tool_router]
diff --git a/hive-agent/Cargo.toml b/hive-agent/Cargo.toml
index 9be432ce..e6680cf2 100644
--- a/hive-agent/Cargo.toml
+++ b/hive-agent/Cargo.toml
@@ -44,6 +44,7 @@ serde_json.workspace = true
 swarm-queue-client = { workspace = true, features = [
   "agent-schedules",
   "agent-inference",
+  "agent-permissions",
 ] }
 # This agent's own queue secret, read from the store under its own certificate.
 swarm-secret-client.workspace = true
diff --git a/hive-agent/README.md b/hive-agent/README.md
index 54c38be0..54a7fbad 100644
--- a/hive-agent/README.md
+++ b/hive-agent/README.md
@@ -30,7 +30,7 @@ map of the module tree.
 - **`login.rs` / `login_session.rs`** — first-run and session-resume
   auth flow for the `claude` CLI.
 - **`mcp_config.rs`** — renders the per-turn `--mcp-config` /
-  `--allowedTools` blob from tool groups + capabilities.
+  `--allowedTools` blob from the agent's permissions.
 - **`todos.rs` / `reminders.rs` / `todo_server.rs`** — the harness-local
   loose-ends v2 stores (sqlite-backed) and the in-agent socket server
   extra MCP daemons + `hive-agent-mcp` dial into for todo/reminder ops.
diff --git a/hive-agent/src/main.rs b/hive-agent/src/main.rs
index ded89a04..e857f517 100644
--- a/hive-agent/src/main.rs
+++ b/hive-agent/src/main.rs
@@ -36,6 +36,7 @@ mod swarm_agent_icon;
 mod swarm_agent_state;
 mod swarm_inference;
 mod swarm_input;
+mod swarm_permissions;
 mod swarm_queue;
 mod swarm_term;
 mod term_msg;
@@ -496,6 +497,8 @@ async fn serve_main<S: Surface>(socket: &Path, poll_ms: u64) -> Result<()> {
     swarm_agent_icon::spawn();
     // The model and effort the swarm sets for this agent, over its local ones.
     tokio::spawn(swarm_inference::run(bus.clone()));
+    // The permissions the swarm grants this agent, read before each turn.
+    tokio::spawn(swarm_permissions::run());
     // Set by the web UI's `/api/cancel` on a successful SIGINT, read-and-
     // cleared by `handle_turn` before building the next wake prompt — see
     // `hive_sh4re::inbox::INTERRUPTED_HINT`. Shared between the web server task and
diff --git a/hive-agent/src/mcp_config.rs b/hive-agent/src/mcp_config.rs
index 5edb9204..c57e5b06 100644
--- a/hive-agent/src/mcp_config.rs
+++ b/hive-agent/src/mcp_config.rs
@@ -1,4 +1,4 @@
-//! Claude launch-config layer: resolves the agent's tool-group / capability
+//! Claude launch-config layer: resolves the agent's permission
 //! set into the `--allowedTools` / `--tools` argument strings and renders the
 //! `--mcp-config` blob claude reads at spawn (built-in hyperhive server +
 //! any `services.hyperhive.agent.extraMcpServers`). Pure config-string generation consumed by
@@ -6,6 +6,8 @@
 //! running MCP server (a separate binary) — the `send` allow-list check that
 //! server enforces lives alongside it in the `hive-agent-mcp` crate.
 
+use hive_sh4re::permissions::Permission;
+
 /// Name of the hyperhive MCP server inside claude's view. Claude prefixes
 /// tools as `mcp__<this>__<tool>` (e.g. `mcp__hyperhive__send`).
 pub const SERVER_NAME: &str = "hyperhive";
@@ -18,87 +20,83 @@ pub const SERVER_NAME: &str = "hyperhive";
 /// so `127.0.0.1:<port>` is per-container-private (no cross-agent collision).
 pub const DEFAULT_MCP_HTTP_PORT: u16 = 8790;
 
-/// The built-in tool surface — the base list, the group-gated additions, the
-/// `HIVE_TOOL_GROUPS` parse, and the `--tools` value they resolve to — lives
-/// in `hive_sh4re::permissions`, next to `ToolGroup` itself. Re-exported here
-/// because this module is where the rest of the claude launch config is
-/// assembled, and because the subagent daemon (`hive-subagent-mcp`) spawns
-/// its own `claude` from the same base resolution (plus its own `Bash`
-/// exception — see `hive_sh4re::permissions::subagent_builtin_tools_arg`):
-/// `hive-agent` is a binary-only crate with no lib target, so a shared home
-/// was the only way for both spawners to read one list rather than two that
-/// drift.
-pub use hive_sh4re::permissions::{builtin_tools_arg, effective_tool_groups};
+/// The value for claude's `--tools` flag this turn: which built-in tools exist
+/// in the session at all, from the agent's current permissions. The
+/// resolution lives in `hive_sh4re::permissions` because the subagent daemon
+/// (`hive-subagent-mcp`) spawns its own `claude` from the same one.
+#[must_use]
+pub fn builtin_tools_arg() -> String {
+    hive_sh4re::permissions::builtin_tools_for(&crate::swarm_permissions::current()).join(",")
+}
 
-/// Tool group an extra (out-of-process) MCP server is gated behind, if any.
+/// Permission an extra (out-of-process) MCP server is gated behind, if any.
 ///
 /// Most `services.hyperhive.agent.extraMcpServers` entries are ungated — available whenever
 /// the operator declares them. The `bash` server is the exception: raw shell
-/// execution is a privilege, so it is only exposed when the agent holds the
-/// `Execution` tool group. Unlike the in-process hyperhive tools (gated at
-/// dispatch) and the capability tools (re-checked server-side by hive-c0re),
+/// execution is a privilege, so it is only exposed when the agent holds
+/// `Execution`. Unlike the in-process hyperhive tools (gated at dispatch),
 /// an out-of-process server has **no** later enforcement point — once it is
 /// in the claude MCP config the agent can call it. So this gate, applied at
 /// config-render time, is the security boundary for those servers.
-fn extra_server_required_group(server: &str) -> Option<hive_sh4re::permissions::ToolGroup> {
+fn extra_server_required_permission(server: &str) -> Option<Permission> {
     match server {
-        "bash" => Some(hive_sh4re::permissions::ToolGroup::Execution),
+        "bash" => Some(Permission::Execution),
         _ => None,
     }
 }
 
-/// Whether an extra MCP server should be exposed to claude given the active
-/// tool `groups`. A gated server (see [`extra_server_required_group`]) is
-/// suppressed when the agent lacks its required group.
-fn extra_server_enabled(server: &str, groups: &[hive_sh4re::permissions::ToolGroup]) -> bool {
-    extra_server_required_group(server).is_none_or(|required| groups.contains(&required))
+/// Whether an extra MCP server should be exposed to claude given the agent's
+/// `perms`. A gated server (see [`extra_server_required_permission`]) is
+/// suppressed when the agent lacks its required permission.
+fn extra_server_enabled(server: &str, perms: &[Permission]) -> bool {
+    extra_server_required_permission(server).is_none_or(|required| perms.contains(&required))
 }
 
 #[cfg(test)]
 mod extra_server_gate_tests {
-    use super::{extra_server_enabled, extra_server_required_group};
-    use hive_sh4re::permissions::ToolGroup;
+    use super::{extra_server_enabled, extra_server_required_permission};
+    use hive_sh4re::permissions::Permission;
 
     #[test]
     fn bash_is_gated_behind_execution() {
         assert_eq!(
-            extra_server_required_group("bash"),
-            Some(ToolGroup::Execution)
+            extra_server_required_permission("bash"),
+            Some(Permission::Execution)
         );
         // Suppressed without Execution, even if other groups are present.
         assert!(!extra_server_enabled(
             "bash",
-            &[ToolGroup::Messaging, ToolGroup::Inbox]
+            &[Permission::Messaging, Permission::Inbox]
         ));
         // Available once Execution is granted.
-        assert!(extra_server_enabled("bash", &[ToolGroup::Execution]));
+        assert!(extra_server_enabled("bash", &[Permission::Execution]));
     }
 
     #[test]
     fn other_servers_are_ungated() {
-        assert_eq!(extra_server_required_group("matrix"), None);
-        assert_eq!(extra_server_required_group("scraper"), None);
+        assert_eq!(extra_server_required_permission("matrix"), None);
+        assert_eq!(extra_server_required_permission("scraper"), None);
         // An ungated server is available regardless of (even empty) groups.
         assert!(extra_server_enabled("matrix", &[]));
-        assert!(extra_server_enabled("scraper", &[ToolGroup::Messaging]));
+        assert!(extra_server_enabled("scraper", &[Permission::Messaging]));
     }
 }
 
 /// MCP tools claude is allowed to call without prompting, derived from
-/// the supplied tool groups. Adding a new `#[tool]` fn to a server impl
-/// requires updating the matching `ToolGroup::tools()` slice in hive-sh4re
-/// (single source of truth). See `docs/process/conventions.md::Tool groups`.
+/// the supplied permissions. Adding a new `#[tool]` fn to a server impl
+/// requires updating the matching `Permission::tools()` slice in hive-sh4re
+/// (single source of truth).
 #[must_use]
-pub fn allowed_mcp_tools(groups: &[hive_sh4re::permissions::ToolGroup]) -> Vec<String> {
+pub fn allowed_mcp_tools(perms: &[Permission]) -> Vec<String> {
     // Collect all tool names, deduplicating while preserving order.
     // Always-on tools (e.g. `set_status`) come first so they're present
-    // regardless of which groups the agent is granted — a misconfigured
+    // regardless of which permissions the agent holds — a misconfigured
     // agent still has to be able to report its dashboard status.
     let mut seen = std::collections::HashSet::new();
-    let mut out: Vec<String> = hive_sh4re::permissions::ToolGroup::ALWAYS_ON_TOOLS
+    let mut out: Vec<String> = Permission::ALWAYS_ON_TOOLS
         .iter()
         .copied()
-        .chain(groups.iter().flat_map(|g| g.tools().iter().copied()))
+        .chain(perms.iter().flat_map(|p| p.tools().iter().copied()))
         .filter(|t| seen.insert(*t))
         .map(|t| format!("mcp__{SERVER_NAME}__{t}"))
         .collect();
@@ -108,7 +106,7 @@ pub fn allowed_mcp_tools(groups: &[hive_sh4re::permissions::ToolGroup]) -> Vec<S
     // them without per-tool operator approval. `["*"]` (the default)
     // expands to `mcp__<server>__*` — every tool from that server.
     for (server, spec) in hive_agent_sock::extra_mcp::load_extra_mcp() {
-        if server == SERVER_NAME || !extra_server_enabled(&server, groups) {
+        if server == SERVER_NAME || !extra_server_enabled(&server, perms) {
             continue;
         }
         for pat in spec.allowed_tools() {
@@ -122,14 +120,14 @@ pub fn allowed_mcp_tools(groups: &[hive_sh4re::permissions::ToolGroup]) -> Vec<S
 /// both the built-ins and the MCP surface.
 #[must_use]
 pub fn allowed_tools_arg() -> String {
-    let groups = effective_tool_groups();
+    let perms = crate::swarm_permissions::current();
     // The same built-ins `--tools` makes exist this session, so a tool that
     // exists is never one claude has to prompt about.
-    let mut all: Vec<String> = hive_sh4re::permissions::builtin_tools_for(&groups)
+    let mut all: Vec<String> = hive_sh4re::permissions::builtin_tools_for(&perms)
         .into_iter()
         .map(ToOwned::to_owned)
         .collect();
-    all.extend(allowed_mcp_tools(&groups));
+    all.extend(allowed_mcp_tools(&perms));
     all.join(",")
 }
 
@@ -148,7 +146,7 @@ pub fn render_claude_config() -> String {
 
 /// The set of MCP server names claude is configured with this turn — the
 /// keys of the rendered `--mcp-config` (built-in hyperhive HTTP surface +
-/// any tool-group-permitted extra servers). The harness compares
+/// any permitted extra servers). The harness compares
 /// this against the per-turn `system`/`init` event's `mcp_servers` to
 /// detect a configured server that failed to connect or was dropped
 /// (the MCP-health instrumentation).
@@ -158,7 +156,7 @@ pub fn configured_server_names() -> Vec<String> {
 }
 
 /// Build the `mcpServers` map claude gets in its `--mcp-config`: the
-/// built-in hyperhive HTTP surface plus any tool-group-permitted extra
+/// built-in hyperhive HTTP surface plus any permitted extra
 /// servers (stdio or http, per each entry's `type`). Shared by
 /// [`render_claude_config`] (serialises it) and [`configured_server_names`]
 /// (lists its keys) so the two never drift.
@@ -187,11 +185,11 @@ fn build_mcp_servers() -> serde_json::Map<String, serde_json::Value> {
     // (Http entries have no child-process env to inject into — the daemon
     // behind the URL resolves its own state dir independently.)
     let state_dir = crate::paths::state_dir();
-    // Gate tool-group-restricted extra servers (e.g. `bash` → `Execution`).
+    // Gate permission-restricted extra servers (e.g. `bash` → `Execution`).
     // This is the security boundary for them: an out-of-process server the
     // agent isn't entitled to must not even appear in the MCP config, or the
     // agent could call it directly (there is no later enforcement point).
-    let groups = effective_tool_groups();
+    let perms = crate::swarm_permissions::current();
     for (name, spec) in hive_agent_sock::extra_mcp::load_extra_mcp() {
         if name == SERVER_NAME {
             tracing::warn!(
@@ -199,10 +197,10 @@ fn build_mcp_servers() -> serde_json::Map<String, serde_json::Value> {
             );
             continue;
         }
-        if !extra_server_enabled(&name, &groups) {
+        if !extra_server_enabled(&name, &perms) {
             tracing::info!(
                 server = %name,
-                "extra MCP server suppressed: agent lacks the required tool group"
+                "extra MCP server suppressed: agent lacks the required permission"
             );
             continue;
         }
@@ -214,7 +212,7 @@ fn build_mcp_servers() -> serde_json::Map<String, serde_json::Value> {
 #[cfg(test)]
 mod tests {
     use super::{SERVER_NAME, allowed_mcp_tools};
-    use hive_sh4re::permissions::ToolGroup;
+    use hive_sh4re::permissions::Permission;
 
     fn qualified(tool: &str) -> String {
         format!("mcp__{SERVER_NAME}__{tool}")
@@ -222,7 +220,7 @@ mod tests {
 
     #[test]
     fn set_status_present_with_no_groups() {
-        // An agent with zero tool groups (or any group set that omits
+        // An agent with no permissions (or any set that omits
         // `meta`) must still be able to report its dashboard status.
         let tools = allowed_mcp_tools(&[]);
         assert!(
@@ -234,7 +232,7 @@ mod tests {
     #[test]
     fn mark_todos_done_present_with_no_groups() {
         // Regression: mark_todos_done was declared as a
-        // tool but never added to any ToolGroup, so no agent could ever
+        // tool but never added to any group, so no agent could ever
         // get it into --allowedTools regardless of which groups it held —
         // including `inbox`, which only gates get_loose_ends/
         // cancel_loose_end/remind.
@@ -243,13 +241,13 @@ mod tests {
             tools.contains(&qualified("mark_todos_done")),
             "mark_todos_done missing from empty-group allow-list: {tools:?}"
         );
-        let tools = allowed_mcp_tools(&[ToolGroup::Inbox]);
+        let tools = allowed_mcp_tools(&[Permission::Inbox]);
         assert!(tools.contains(&qualified("mark_todos_done")));
     }
 
     #[test]
     fn set_status_present_without_meta_group() {
-        let tools = allowed_mcp_tools(&[ToolGroup::Messaging, ToolGroup::Inbox]);
+        let tools = allowed_mcp_tools(&[Permission::Messaging, Permission::Inbox]);
         assert!(tools.contains(&qualified("set_status")));
         // get_agent_meta stays gated behind `meta` — only set_status is always-on.
         assert!(!tools.contains(&qualified("get_agent_meta")));
@@ -257,7 +255,7 @@ mod tests {
 
     #[test]
     fn no_duplicate_set_status_when_meta_granted() {
-        let tools = allowed_mcp_tools(&[ToolGroup::Meta]);
+        let tools = allowed_mcp_tools(&[Permission::Meta]);
         let count = tools
             .iter()
             .filter(|t| **t == qualified("set_status"))
diff --git a/hive-agent/src/swarm_permissions.rs b/hive-agent/src/swarm_permissions.rs
new file mode 100644
index 00000000..59d0aed2
--- /dev/null
+++ b/hive-agent/src/swarm_permissions.rs
@@ -0,0 +1,181 @@
+//! The permissions the swarm grants this agent.
+//!
+//! swarm-controller keeps the agent's set under its key in the
+//! `agent-permissions` KV bucket. This task reads that key every
+//! [`POLL_INTERVAL`] with the one subject the agent's own queue credential is
+//! granted there, and [`current`] answers with the last value read. The turn
+//! loop asks [`current`] for every turn's `--tools`, `--allowedTools` and MCP
+//! config, so a change reaches the next turn.
+//!
+//! Until the first successful read after a start, the agent holds what
+//! hive-c0re stored for it ([`HiveCopy::before_read`]), so a queue that is down
+//! or slow leaves it on its last known grant, not the default. A read is
+//! judged by [`HiveCopy::after_read`]: an unset key is the default, except
+//! while the hive's import is pending. A failed read keeps the last value.
+
+use std::path::Path;
+use std::sync::{PoisonError, RwLock};
+use std::time::Duration;
+
+use hive_sh4re::permissions::Permission;
+use swarm_queue_client::agent_permissions::{HIVE_COPY_PATH, HiveCopy, Read, read};
+
+/// How often the key is read. Also the longest a change can take to reach
+/// the agent's next turn.
+const POLL_INTERVAL: Duration = Duration::from_secs(10);
+
+/// The last value read; `None` until the first read succeeds.
+static CURRENT: RwLock<Option<Vec<Permission>>> = RwLock::new(None);
+
+/// The permissions this agent holds now.
+#[must_use]
+pub fn current() -> Vec<Permission> {
+    let last = CURRENT
+        .read()
+        .unwrap_or_else(PoisonError::into_inner)
+        .clone();
+    current_with(last, Path::new(HIVE_COPY_PATH), &crate::identity::label())
+}
+
+/// [`current`] with the last read and the hive's copy given.
+fn current_with(last: Option<Vec<Permission>>, copy: &Path, agent: &str) -> Vec<Permission> {
+    last.unwrap_or_else(|| HiveCopy::read_at(copy).before_read(agent))
+}
+
+/// What one read of the key leaves the agent holding, judged against the
+/// hive's copy at `copy`; `None` (keep the last value) when the read failed
+/// or the bucket did not answer.
+fn after(agent: &str, copy: &Path, read: Option<Read>) -> Option<Vec<Permission>> {
+    match read? {
+        Read::Current(record) => Some(HiveCopy::read_at(copy).after_read(agent, &record)),
+        Read::NoBucket => None,
+    }
+}
+/// Run the poller for the harness's lifetime, if this agent has a label to
+/// name its key with.
+pub async fn run() {
+    let agent = crate::identity::label();
+    if agent.is_empty() {
+        tracing::warn!("this agent has no label; not reading its swarm permissions");
+        return;
+    }
+    let client = crate::swarm_queue::client().await;
+    tracing::info!(%agent, "reading swarm permissions from the swarm queue");
+    loop {
+        let read = read_once(&client, &agent).await;
+        if let Some(perms) = after(&agent, Path::new(HIVE_COPY_PATH), read) {
+            let mut current = CURRENT.write().unwrap_or_else(PoisonError::into_inner);
+            if current.as_ref() != Some(&perms) {
+                tracing::info!(?perms, "permissions: the swarm's set changed");
+                *current = Some(perms);
+            }
+        }
+        tokio::time::sleep(POLL_INTERVAL).await;
+    }
+}
+
+/// The key's current value, or `None` when it could not be read.
+async fn read_once(client: &async_nats::Client, agent: &str) -> Option<Read> {
+    // An unconnected client does not fail a JetStream request, it hangs on it.
+    swarm_queue_client::ensure_connected(client).ok()?;
+    match read(client, agent).await {
+        Ok(read) => Some(read),
+        Err(e) => {
+            tracing::warn!(error = %e, "permissions: reading this agent's key failed");
+            None
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn record(json: &str) -> Read {
+        Read::Current(serde_json::from_str(json).expect("decodes"))
+    }
+
+    /// A hive's copy holding `json`, in a tempdir kept alive by the guard.
+    fn copy(json: &str) -> (tempfile::TempDir, std::path::PathBuf) {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("swarm-permissions.json");
+        std::fs::write(&path, json).expect("write the copy");
+        (dir, path)
+    }
+
+    #[test]
+    fn a_read_sets_the_list_or_the_default_and_a_failure_keeps_the_last() {
+        let none = Path::new("/nonexistent/swarm-permissions.json");
+        assert_eq!(
+            after(
+                "atlas",
+                none,
+                Some(record(r#"{"permissions":["web_tools"]}"#))
+            ),
+            Some(vec![Permission::WebTools])
+        );
+        assert_eq!(
+            after("atlas", none, Some(record(r#"{"permissions":[]}"#))),
+            Some(Vec::new())
+        );
+        assert_eq!(
+            after("atlas", none, Some(record("{}"))),
+            Some(Permission::DEFAULT.to_vec())
+        );
+        assert_eq!(after("atlas", none, Some(Read::NoBucket)), None);
+        assert_eq!(after("atlas", none, None), None);
+    }
+
+    #[test]
+    fn before_the_first_read_the_stored_grant_applies() {
+        let (_dir, path) = copy(r#"{"permissions":["web_tools"]}"#);
+        assert_eq!(
+            current_with(None, &path, "atlas"),
+            vec![Permission::WebTools]
+        );
+        let (_dir, path) = copy(r#"{"permissions":[]}"#);
+        assert_eq!(current_with(None, &path, "atlas"), Vec::new());
+        assert_eq!(
+            current_with(Some(vec![Permission::Meta]), &path, "atlas"),
+            vec![Permission::Meta],
+            "a read outranks the copy"
+        );
+    }
+
+    #[test]
+    fn while_the_import_is_pending_an_unset_key_keeps_the_stored_grant() {
+        let (_dir, path) = copy(r#"{"permissions":["web_tools"],"import_pending":true}"#);
+        assert_eq!(
+            after("atlas", &path, Some(record("{}"))),
+            Some(vec![Permission::WebTools])
+        );
+        assert_eq!(
+            after("atlas", &path, Some(record(r#"{"permissions":["meta"]}"#))),
+            Some(vec![Permission::Meta]),
+            "a set key still wins"
+        );
+        let (_dir, path) = copy(r#"{"permissions":["web_tools"]}"#);
+        assert_eq!(
+            after("atlas", &path, Some(record("{}"))),
+            Some(Permission::DEFAULT.to_vec()),
+            "once imported, unset is the default"
+        );
+    }
+
+    /// No read ever succeeds: the last value stays unset and the agent holds
+    /// the hive's stored grant.
+    #[test]
+    fn with_the_queue_down_the_agent_holds_the_stored_grant() {
+        let (_dir, path) = copy(r#"{"permissions":["messaging"],"import_pending":true}"#);
+        let mut last = None;
+        for read in [None, Some(Read::NoBucket), None] {
+            if let Some(perms) = after("atlas", &path, read) {
+                last = Some(perms);
+            }
+        }
+        assert_eq!(
+            current_with(last, &path, "atlas"),
+            vec![Permission::Messaging]
+        );
+    }
+}
diff --git a/hive-agent/src/turn.rs b/hive-agent/src/turn.rs
index 61c8b0fe..2203241a 100644
--- a/hive-agent/src/turn.rs
+++ b/hive-agent/src/turn.rs
@@ -91,10 +91,12 @@ and end the turn.";
 /// prompt (`--system-prompt-file`). Static settings are no longer
 /// passed here — they live at `/etc/claude-code/managed-settings.json`
 /// and claude auto-discovers them.
-/// Materialised once at harness startup; shared between the turn loop
-/// and the operator-driven `/compact` path so both invocations look
-/// identical to claude (same MCP surface, same allowed tools, same
-/// role prompt — only the stdin payload differs).
+/// Materialised at harness startup; shared between the turn loop and the
+/// operator-driven `/compact` path so both invocations look identical to
+/// claude (same MCP surface, same allowed tools, same role prompt — only the
+/// stdin payload differs). The MCP config is rewritten before each
+/// invocation ([`TurnFiles::refresh_mcp_config`]), since which servers it
+/// holds follows the agent's current permissions.
 #[derive(Clone)]
 pub struct TurnFiles {
     pub mcp_config: PathBuf,
@@ -114,6 +116,16 @@ impl TurnFiles {
             system_prompt: write_system_prompt(socket, label).await?,
         })
     }
+
+    /// Rewrite the MCP config from the agent's current permissions, so a
+    /// change to `execution` reaches this invocation's `bash` server. A
+    /// failed write is logged and the previous file stays.
+    pub async fn refresh_mcp_config(&self) {
+        if let Err(e) = tokio::fs::write(&self.mcp_config, mcp_config::render_claude_config()).await
+        {
+            tracing::warn!(path = %self.mcp_config.display(), error = %e, "rewriting the claude MCP config failed");
+        }
+    }
 }
 
 /// Drop the MCP config blob claude reads from `--mcp-config <path>`.
@@ -335,22 +347,25 @@ pub fn make_session(bus: &Bus) -> Result<AgentSession> {
     })
 }
 
-/// The answer to an ACP agent's permission requests, see [`acp_permits`].
+/// The answer to an ACP agent's permission requests, see [`acp_permits`],
+/// against the agent's permissions at the moment it asks.
 fn acp_permission_policy() -> PermissionPolicy {
-    let web =
-        mcp_config::effective_tool_groups().contains(&hive_sh4re::permissions::ToolGroup::WebTools);
-    std::sync::Arc::new(move |ask: &PermissionAsk<'_>| acp_permits(ask, web))
+    std::sync::Arc::new(|ask: &PermissionAsk<'_>| {
+        let web = crate::swarm_permissions::current()
+            .contains(&hive_sh4re::permissions::Permission::WebTools);
+        acp_permits(ask, web)
+    })
 }
 
 /// Whether an ACP agent may run the tool call it asks about. Default-deny,
 /// allowing what a claude agent has:
 ///
 /// - `other`-kind calls to tools of the MCP servers the session was handed
-///   — which of those an agent gets is already decided by its tool groups
+///   — which of those an agent gets is already decided by its permissions
 ///   (`mcp_config`);
 /// - the file tools, mirroring the claude built-ins
 ///   (`hive_sh4re::permissions`): `read`, `edit`, `search`;
-/// - `fetch` with the `web_tools` group (`web`).
+/// - `fetch` with the `web_tools` permission (`web`).
 ///
 /// Everything else is refused, including a built-in shell (`execute`) —
 /// shell goes through `mcp__bash__run` — and any kind this list doesn't name.
@@ -395,6 +410,7 @@ pub async fn drive_turn(
         // Heuristic: context large AND prompt cache gone cold.
         maybe_auto_reset(bus, session);
     }
+    files.refresh_mcp_config().await;
     let config = claude_config(bus, files);
     let sink = BusSink::new(bus);
     let mut result = session.run(&config, prompt, &sink).await;
@@ -621,6 +637,7 @@ pub async fn run_pending_compact(files: &TurnFiles, bus: &Bus, session: &AgentSe
         text: "operator: /compact — running on idle session".into(),
     });
     bus.set_state(crate::events::TurnState::Compacting);
+    files.refresh_mcp_config().await;
     let config = claude_config(bus, files);
     let sink = BusSink::new(bus);
     report_compact(bus, session.compact(&config, &sink).await);
diff --git a/hive-c0re/Cargo.toml b/hive-c0re/Cargo.toml
index 9e8d0f0c..59ee8731 100644
--- a/hive-c0re/Cargo.toml
+++ b/hive-c0re/Cargo.toml
@@ -57,6 +57,7 @@ swarm-queue-client = { workspace = true, features = [
   "kv",
   "notices",
   "agent-limits",
+  "agent-permissions",
 ] }
 swarm-secret-client.workspace = true
 tokio.workspace = true
diff --git a/hive-c0re/README.md b/hive-c0re/README.md
index ee121130..758aed69 100644
--- a/hive-c0re/README.md
+++ b/hive-c0re/README.md
@@ -34,8 +34,8 @@ to track it:
 - **`stores/`** — sqlite-backed stores (broker, queues, audit, power).
 - **`workers/`** — background sweeps (crash watch,
   autoupdate, knowledge sync).
-- **`agent_config/`** — per-agent registries (tool groups,
-  capabilities, resource limits, topology).
+- **`agent_config/`** — per-agent registries (permissions,
+  resource limits, topology).
 - **`stats/`** — dashboard metrics aggregation + OTEL export.
 - **`socket_server/`** — the unix-socket request server shared by
   per-agent + manager sockets.
diff --git a/hive-c0re/src/agent_config/capabilities.rs b/hive-c0re/src/agent_config/capabilities.rs
deleted file mode 100644
index c520b0e6..00000000
--- a/hive-c0re/src/agent_config/capabilities.rs
+++ /dev/null
@@ -1,262 +0,0 @@
-//! Per-agent capability configuration. Stored at
-//! `/var/lib/hyperhive/meta/capabilities.json` alongside `topology.json`
-//! and `tool-groups.json`.
-//!
-//! Format: a JSON object mapping agent name to an array of
-//! `hive_sh4re::permissions::Capability` `snake_case` strings:
-//!
-//! ```json
-//! {
-//!   "atlas": ["manage_root_agent"]
-//! }
-//! ```
-//!
-//! An absent entry (or an absent file) means "no extra capabilities".
-//! `render_flake` in `meta.rs` reads this file and injects
-//! `HIVE_CAPABILITIES` into each agent's systemd service env; absent
-//! entries emit no env var so agents without capabilities don't trigger
-//! a spurious rebuild.
-//!
-//! Write path: `set_caps` is called from the dashboard action handler
-//! that the operator uses to grant/revoke capabilities per agent.
-
-use hive_sh4re::permissions::Capability;
-use std::collections::BTreeMap;
-use std::path::{Path, PathBuf};
-
-const CAPABILITIES_FILE: &str = "capabilities.json";
-
-#[must_use]
-pub fn capabilities_path() -> PathBuf {
-    crate::paths::meta_root().join(CAPABILITIES_FILE)
-}
-
-/// True if `name` matches a recognised [`Capability`], case-insensitive
-/// (same comparison [`has_cap`] uses).
-#[must_use]
-fn is_known(name: &str) -> bool {
-    Capability::ALL
-        .iter()
-        .any(|cap| name.eq_ignore_ascii_case(<&str>::from(*cap)))
-}
-
-/// Drop any capability string in `map` that isn't a recognised
-/// [`Capability`], warning per dropped string so a typo'd or stale
-/// grant doesn't look like it worked. An agent left with no
-/// capabilities is removed entirely, matching [`set_caps`]'s
-/// empty-vec behaviour. Returns whether anything was dropped.
-fn prune_unknown(map: &mut BTreeMap<String, Vec<String>>) -> bool {
-    let mut dropped_any = false;
-    map.retain(|agent, caps| {
-        caps.retain(|cap| {
-            let known = is_known(cap);
-            if !known {
-                dropped_any = true;
-                tracing::warn!(agent, capability = %cap, "dropping unrecognised capability");
-            }
-            known
-        });
-        !caps.is_empty()
-    });
-    dropped_any
-}
-
-/// Read the per-agent capability map. An absent file is the empty map —
-/// callers treat a missing entry as "no extra capabilities". A file
-/// that exists but can't be read or parsed is an error. Any entry that
-/// isn't a recognised [`Capability`] is dropped (with a `warn!`) from
-/// what's returned — a stale or typo'd name is never honoured — but
-/// `read` itself never writes. Unknown names stay on disk until the next
-/// write: `set_caps` always rewrites the file, `remove_agent` only when
-/// the agent had an entry.
-pub fn read() -> std::io::Result<BTreeMap<String, Vec<String>>> {
-    read_from(&capabilities_path())
-}
-
-fn read_from(path: &Path) -> std::io::Result<BTreeMap<String, Vec<String>>> {
-    let mut map = super::read_map(path)?;
-    prune_unknown(&mut map);
-    Ok(map)
-}
-
-/// Look up the configured capabilities for one agent in the file at
-/// `path` (normally [`capabilities_path`]). Returns an empty vec when
-/// the agent has no entry. Errors as [`read`] does.
-pub fn caps_for(path: &Path, name: &str) -> std::io::Result<Vec<String>> {
-    Ok(read_from(path)?.get(name).cloned().unwrap_or_default())
-}
-
-/// Check whether an agent holds a specific capability, per the file at
-/// `path` (normally [`capabilities_path`]). Errors as [`read`] does.
-pub fn has_cap(
-    path: &Path,
-    name: &str,
-    cap: hive_sh4re::permissions::Capability,
-) -> std::io::Result<bool> {
-    Ok(caps_for(path, name)?
-        .iter()
-        .any(|s| s.eq_ignore_ascii_case(<&str>::from(cap))))
-}
-
-/// Filter `caps` down to recognised [`Capability`] names (warning per
-/// drop) and apply the result to `current` for `name`: an empty
-/// result — whether `caps` started empty or every name in it was
-/// unknown — removes the entry, matching `read`'s empty-entry
-/// convention. Split out from [`set_caps`] so the decision logic is
-/// testable without touching the real capabilities file.
-fn apply_known_caps(current: &mut BTreeMap<String, Vec<String>>, name: &str, caps: &[String]) {
-    let known: Vec<String> = caps
-        .iter()
-        .filter(|cap| {
-            let ok = is_known(cap);
-            if !ok {
-                tracing::warn!(agent = name, capability = %cap, "dropping unrecognised capability");
-            }
-            ok
-        })
-        .cloned()
-        .collect();
-    if known.is_empty() {
-        current.remove(name);
-    } else {
-        current.insert(name.to_owned(), known);
-    }
-}
-
-/// Set the capabilities for one agent and persist the map. Any name
-/// that isn't a recognised [`Capability`] is dropped (with a `warn!`)
-/// rather than written — an unknown grant should never look like it
-/// took effect. An empty `caps` vec, or one that becomes empty after
-/// dropping unknown names, removes the entry (agent has no
-/// capabilities). Fails without writing if the existing file can't be
-/// read or parsed.
-pub fn set_caps(name: &str, caps: &[String]) -> std::io::Result<()> {
-    set_caps_at(&capabilities_path(), name, caps)
-}
-
-fn set_caps_at(path: &Path, name: &str, caps: &[String]) -> std::io::Result<()> {
-    let mut current = read_from(path)?;
-    apply_known_caps(&mut current, name, caps);
-    super::write_map(path, &current)
-}
-
-/// Remove an agent from the capability map entirely. Called by
-/// `meta::sync_agents` when an agent is deprovisioned so stale entries
-/// don't accumulate. No-op if the agent has no entry. Fails without
-/// writing if the existing file can't be read or parsed.
-pub fn remove_agent(name: &str) -> std::io::Result<()> {
-    remove_agent_at(&capabilities_path(), name)
-}
-
-fn remove_agent_at(path: &Path, name: &str) -> std::io::Result<()> {
-    let mut current = read_from(path)?;
-    if current.remove(name).is_some() {
-        super::write_map(path, &current)?;
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    // `read`/`set_caps`/`remove_agent` call `crate::paths::meta_root`,
-    // which is hardcoded to `/var/lib/hyperhive` (no test override) — so
-    // these tests pin the pure decision logic (`prune_unknown`,
-    // `apply_known_caps`) against in-memory maps, and the file handling
-    // through the path-taking `*_at` / `read_from` variants.
-
-    const TRUNCATED: &str = "{\n  \"atlas\": [\"manage_root_ag";
-
-    fn corrupt_file() -> (tempfile::TempDir, std::path::PathBuf) {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join(CAPABILITIES_FILE);
-        std::fs::write(&path, TRUNCATED).expect("seed");
-        (dir, path)
-    }
-
-    #[test]
-    fn read_of_a_corrupt_file_is_an_error() {
-        let (_dir, path) = corrupt_file();
-        read_from(&path).expect_err("truncated JSON must not read as a map");
-    }
-
-    #[test]
-    fn set_caps_leaves_a_corrupt_file_untouched() {
-        let (_dir, path) = corrupt_file();
-        let err = set_caps_at(&path, "ruth", &["manage_root_agent".to_owned()])
-            .expect_err("a corrupt file must not be overwritten");
-        assert_eq!(err.kind(), std::io::ErrorKind::InvalidData);
-        assert_eq!(std::fs::read(&path).expect("read"), TRUNCATED.as_bytes());
-    }
-
-    #[test]
-    fn remove_agent_leaves_a_corrupt_file_untouched() {
-        let (_dir, path) = corrupt_file();
-        let err =
-            remove_agent_at(&path, "atlas").expect_err("a corrupt file must not be overwritten");
-        assert_eq!(err.kind(), std::io::ErrorKind::InvalidData);
-        assert_eq!(std::fs::read(&path).expect("read"), TRUNCATED.as_bytes());
-    }
-
-    #[test]
-    fn set_caps_round_trips_through_a_missing_file() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join(CAPABILITIES_FILE);
-        assert!(read_from(&path).expect("missing file is empty").is_empty());
-        set_caps_at(&path, "ruth", &["manage_root_agent".to_owned()]).expect("set");
-        let map = read_from(&path).expect("read");
-        assert_eq!(map["ruth"], vec!["manage_root_agent".to_owned()]);
-    }
-
-    #[test]
-    fn prune_unknown_keeps_known_name() {
-        let mut map = BTreeMap::from([("atlas".to_owned(), vec!["manage_root_agent".to_owned()])]);
-        assert!(!prune_unknown(&mut map));
-        assert_eq!(map["atlas"], vec!["manage_root_agent".to_owned()]);
-    }
-
-    #[test]
-    fn prune_unknown_drops_unrecognised_name() {
-        let mut map = BTreeMap::from([("atlas".to_owned(), vec!["fly_to_the_moon".to_owned()])]);
-        assert!(prune_unknown(&mut map));
-        assert!(!map.contains_key("atlas"));
-    }
-
-    #[test]
-    fn prune_unknown_keeps_known_and_drops_unknown_in_same_entry() {
-        let mut map = BTreeMap::from([(
-            "atlas".to_owned(),
-            vec!["manage_root_agent".to_owned(), "fly_to_the_moon".to_owned()],
-        )]);
-        assert!(prune_unknown(&mut map));
-        assert_eq!(map["atlas"], vec!["manage_root_agent".to_owned()]);
-    }
-
-    #[test]
-    fn apply_known_caps_removes_entry_on_empty_input() {
-        let mut current =
-            BTreeMap::from([("atlas".to_owned(), vec!["manage_root_agent".to_owned()])]);
-        apply_known_caps(&mut current, "atlas", &[]);
-        assert!(!current.contains_key("atlas"));
-    }
-
-    #[test]
-    fn apply_known_caps_removes_entry_when_only_unknown_names_given() {
-        let mut current =
-            BTreeMap::from([("atlas".to_owned(), vec!["manage_root_agent".to_owned()])]);
-        apply_known_caps(&mut current, "atlas", &["fly_to_the_moon".to_owned()]);
-        assert!(!current.contains_key("atlas"));
-    }
-
-    #[test]
-    fn apply_known_caps_keeps_only_the_known_name() {
-        let mut current = BTreeMap::new();
-        apply_known_caps(
-            &mut current,
-            "atlas",
-            &["manage_root_agent".to_owned(), "fly_to_the_moon".to_owned()],
-        );
-        assert_eq!(current["atlas"], vec!["manage_root_agent".to_owned()]);
-    }
-}
diff --git a/hive-c0re/src/agent_config/mod.rs b/hive-c0re/src/agent_config/mod.rs
index 04dee8f5..61efb2c6 100644
--- a/hive-c0re/src/agent_config/mod.rs
+++ b/hive-c0re/src/agent_config/mod.rs
@@ -1,17 +1,16 @@
-//! Per-agent configuration registries: tool groups, capabilities,
-//! resource limits, topology (all JSON files under
-//! `/var/lib/hyperhive/meta/`) and the shared wire-protocol size
-//! limits. Each submodule is re-exported at the crate root, so
-//! `crate::topology::…` etc. keep working unchanged.
+//! Per-agent configuration registries: resource limits, topology (JSON files
+//! under `/var/lib/hyperhive/meta/`), the permissions the swarm grants
+//! (outside the meta repo) and the shared wire-protocol size limits. Each
+//! submodule is re-exported at the crate root, so `crate::topology::…` etc.
+//! keep working unchanged.
 //!
 //! Note the two similarly-named modules: [`limits`] caps inline
 //! *message body* sizes on the sockets, while [`resource_limits`] holds
 //! per-agent CPU/memory caps for the container drop-in.
 
-pub mod capabilities;
 pub mod limits;
+pub mod permissions;
 pub mod resource_limits;
-pub mod tool_groups;
 pub mod topology;
 
 use std::io::{self, Write as _};
diff --git a/hive-c0re/src/agent_config/permissions.rs b/hive-c0re/src/agent_config/permissions.rs
new file mode 100644
index 00000000..fc4f94c6
--- /dev/null
+++ b/hive-c0re/src/agent_config/permissions.rs
@@ -0,0 +1,148 @@
+//! The permissions the swarm grants this hive's agents, as last read from the
+//! `agent-permissions` bucket by `workers::swarm_permissions`. Stored at
+//! `/var/lib/hyperhive/swarm-agent-permissions.json`, outside the meta repo:
+//! the swarm is the record, this file is the hive's last read of it.
+//!
+//! Format: agent name → the stored
+//! [`swarm_queue_client::agent_permissions::AgentPermissions`]. An agent with
+//! no entry, or an entry with `permissions` unset, holds
+//! [`Permission::default_for`]; `"permissions": []` holds none.
+//!
+//! hive-c0re enforces one member, [`Permission::ManageRootAgent`]: read by
+//! `lifecycle::host_config::set_nspawn_flags` on every container start, which
+//! is why a change to it takes a restart. The agent reads the tool members
+//! itself, and holds its entry here until its own first read succeeds:
+//! [`hand_at`] copies the entry into the agent's runtime dir.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+use hive_sh4re::permissions::Permission;
+use swarm_queue_client::agent_permissions::{AgentPermissions, HIVE_COPY_FILE, HiveCopy};
+
+const FILE: &str = "swarm-agent-permissions.json";
+
+pub type Stored = BTreeMap<String, AgentPermissions>;
+
+#[must_use]
+pub fn path() -> PathBuf {
+    crate::paths::state_root().join(FILE)
+}
+
+/// Read the stored permissions. An absent file is the empty map: every agent
+/// on its default. A file that exists but can't be read or parsed is an error.
+pub fn read_at(path: &Path) -> std::io::Result<Stored> {
+    super::read_map(path)
+}
+
+/// Persist the permissions atomically.
+pub fn write_at(path: &Path, stored: &Stored) -> std::io::Result<()> {
+    super::write_map(path, stored)
+}
+
+/// The permissions `agent` holds under `record`.
+#[must_use]
+pub fn effective(agent: &str, record: Option<&AgentPermissions>) -> Vec<Permission> {
+    record
+        .and_then(|r| r.permissions.clone())
+        .unwrap_or_else(|| Permission::default_for(agent))
+}
+
+/// Whether `agent` holds `perm` per the file at `path` (normally [`path`]).
+///
+/// # Errors
+///
+/// As [`read_at`].
+pub fn holds(path: &Path, agent: &str, perm: Permission) -> std::io::Result<bool> {
+    Ok(effective(agent, read_at(path)?.get(agent)).contains(&perm))
+}
+
+/// Write `agent`'s [`HiveCopy`] into `runtime_dir`: its entry in the file at
+/// `stored` (normally [`path`]) and `import_pending`. Left alone when the
+/// copy there already says the same.
+///
+/// # Errors
+///
+/// As [`read_at`], or the write failed.
+pub fn hand_at(
+    stored: &Path,
+    import_pending: bool,
+    agent: &str,
+    runtime_dir: &Path,
+) -> std::io::Result<()> {
+    let copy = HiveCopy {
+        stored: read_at(stored)?.remove(agent).unwrap_or_default(),
+        import_pending,
+    };
+    let dest = runtime_dir.join(HIVE_COPY_FILE);
+    if dest.exists() && HiveCopy::read_at(&dest) == copy {
+        return Ok(());
+    }
+    super::write_map(&dest, &copy)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn record(json: &str) -> AgentPermissions {
+        serde_json::from_str(json).expect("decodes")
+    }
+
+    #[test]
+    fn unset_is_the_default_and_an_empty_list_is_none() {
+        assert!(effective("ruth", None).contains(&Permission::ManageRootAgent));
+        assert!(effective("ruth", Some(&record("{}"))).contains(&Permission::ManageRootAgent));
+        assert!(effective("ruth", Some(&record(r#"{"permissions":[]}"#))).is_empty());
+        assert_eq!(effective("atlas", None), Permission::DEFAULT.to_vec());
+        assert_eq!(
+            effective(
+                "atlas",
+                Some(&record(r#"{"permissions":["manage_root_agent"]}"#))
+            ),
+            vec![Permission::ManageRootAgent]
+        );
+    }
+
+    #[test]
+    fn a_missing_file_holds_the_defaults() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join(FILE);
+        assert!(holds(&path, "ruth", Permission::ManageRootAgent).expect("missing is empty"));
+        assert!(!holds(&path, "atlas", Permission::ManageRootAgent).expect("missing is empty"));
+    }
+
+    /// With the queue down nothing is read, so the agent starts on the copy
+    /// written here: the stored grant, not the default.
+    #[test]
+    fn the_agent_is_handed_its_stored_grant_and_whether_the_import_is_pending() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let stored = dir.path().join(FILE);
+        let runtime = dir.path().join("run");
+        write_at(
+            &stored,
+            &Stored::from([(
+                "atlas".to_owned(),
+                record(r#"{"permissions":["web_tools"]}"#),
+            )]),
+        )
+        .expect("seed");
+
+        hand_at(&stored, true, "atlas", &runtime).expect("hand");
+        let copy = HiveCopy::read_at(&runtime.join(HIVE_COPY_FILE));
+        assert!(copy.import_pending);
+        assert_eq!(copy.before_read("atlas"), vec![Permission::WebTools]);
+
+        hand_at(&stored, false, "iris", &runtime).expect("hand");
+        let copy = HiveCopy::read_at(&runtime.join(HIVE_COPY_FILE));
+        assert_eq!(copy, HiveCopy::default(), "no entry is the default");
+    }
+
+    #[test]
+    fn a_corrupt_file_is_an_error() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join(FILE);
+        std::fs::write(&path, "{\n  \"ruth\": {\"permissions\": [\"manage_root_ag").expect("seed");
+        holds(&path, "ruth", Permission::ManageRootAgent).expect_err("truncated JSON");
+    }
+}
diff --git a/hive-c0re/src/agent_config/resource_limits.rs b/hive-c0re/src/agent_config/resource_limits.rs
index d9e058c9..4e8cf6eb 100644
--- a/hive-c0re/src/agent_config/resource_limits.rs
+++ b/hive-c0re/src/agent_config/resource_limits.rs
@@ -3,7 +3,7 @@
 //!
 //! The swarm caps are stored at
 //! `/var/lib/hyperhive/meta/swarm-resource-limits.json` alongside
-//! `topology.json`, `tool-groups.json` and `capabilities.json`.
+//! `topology.json`.
 //!
 //! Format: a JSON object mapping agent name to an object with optional
 //! `cpu_quota` / `memory_max` strings, passed verbatim to systemd's
diff --git a/hive-c0re/src/agent_config/tool_groups.rs b/hive-c0re/src/agent_config/tool_groups.rs
deleted file mode 100644
index 404a5854..00000000
--- a/hive-c0re/src/agent_config/tool_groups.rs
+++ /dev/null
@@ -1,245 +0,0 @@
-//! Per-agent tool-group configuration. Stored at
-//! `/var/lib/hyperhive/meta/tool-groups.json` alongside `topology.json`
-//! and the meta `flake.nix`.
-//!
-//! Format: a JSON object mapping agent name to an array of
-//! `hive_sh4re::permissions::ToolGroup` `snake_case` strings:
-//!
-//! ```json
-//! {
-//!   "alice": ["messaging", "meta", "inbox", "lifecycle"],
-//!   "bob":   ["messaging", "meta", "inbox"]
-//! }
-//! ```
-//!
-//! An absent entry (or an absent file) means "use the harness default"
-//! (`AGENT_DEFAULT`: `messaging + meta + inbox + execution`). `render_flake`
-//! in `meta.rs` reads this file and injects `HIVE_TOOL_GROUPS` into each
-//! agent's systemd service env; agents with no entry get no env var and the
-//! harness falls back to `AGENT_DEFAULT`.
-//!
-//! Write path: `set_groups` is called from the dashboard action handler
-//! that the operator uses to grant/revoke tool groups per agent.
-
-use std::collections::BTreeMap;
-use std::path::{Path, PathBuf};
-
-use anyhow::Context as _;
-
-const TOOL_GROUPS_FILE: &str = "tool-groups.json";
-
-#[must_use]
-pub fn tool_groups_path() -> PathBuf {
-    crate::paths::meta_root().join(TOOL_GROUPS_FILE)
-}
-
-/// Read the per-agent tool-group map. An absent file is the empty map —
-/// callers treat a missing entry as "use role default". A file that
-/// exists but can't be read or parsed is an error. Any entry that isn't a
-/// recognised [`hive_sh4re::permissions::ToolGroup`] is dropped (with a
-/// `warn!`) from what's returned — a stale or renamed name is never
-/// honoured — but `read` itself never writes; unknown names stay on disk
-/// until the next `set_groups` rewrites the file.
-pub fn read() -> std::io::Result<BTreeMap<String, Vec<String>>> {
-    read_from(&tool_groups_path())
-}
-
-fn read_from(path: &Path) -> std::io::Result<BTreeMap<String, Vec<String>>> {
-    let mut map = super::read_map(path)?;
-    prune_unknown(&mut map);
-    Ok(map)
-}
-
-/// True if `name` matches a recognised [`hive_sh4re::permissions::ToolGroup`],
-/// case-insensitive (same comparison [`validate_groups`] uses, and the same
-/// comparison `capabilities::is_known` uses — a hand-edited `"Meta"` in the
-/// file should round-trip, not get pruned).
-fn is_known(name: &str) -> bool {
-    hive_sh4re::permissions::ToolGroup::ALL
-        .iter()
-        .any(|g| name.eq_ignore_ascii_case(<&str>::from(*g)))
-}
-
-/// Drop any tool-group string in `map` that isn't a recognised
-/// [`hive_sh4re::permissions::ToolGroup`], warning per dropped string so a
-/// stale or renamed grant doesn't look like it's still in effect. An agent
-/// left with no groups is removed entirely, matching [`set_groups`]'s
-/// empty-vec behaviour (reverts to the harness role default). Returns
-/// whether anything was dropped.
-fn prune_unknown(map: &mut BTreeMap<String, Vec<String>>) -> bool {
-    let mut dropped_any = false;
-    map.retain(|agent, groups| {
-        groups.retain(|g| {
-            let known = is_known(g);
-            if !known {
-                dropped_any = true;
-                tracing::warn!(agent, tool_group = %g, "dropping unrecognised tool group");
-            }
-            known
-        });
-        !groups.is_empty()
-    });
-    dropped_any
-}
-
-/// Look up the configured tool groups for one agent. Returns an empty
-/// vec when the agent has no entry — callers should treat this as
-/// "use the harness role default." Errors as [`read`] does.
-pub fn groups_for(name: &str) -> std::io::Result<Vec<String>> {
-    Ok(read()?.get(name).cloned().unwrap_or_default())
-}
-
-/// Validate a slice of group name strings against `ToolGroup::ALL`.
-/// Returns `Ok(())` when all names are known, or `Err` listing the
-/// unrecognised names so callers can surface a useful error message.
-pub fn validate_groups(groups: &[String]) -> anyhow::Result<()> {
-    let unknown: Vec<&str> = groups
-        .iter()
-        .map(String::as_str)
-        .filter(|s| !is_known(s))
-        .collect();
-    if unknown.is_empty() {
-        Ok(())
-    } else {
-        anyhow::bail!(
-            "unknown tool group(s): {}; valid names are: {}",
-            unknown.join(", "),
-            hive_sh4re::permissions::ToolGroup::ALL
-                .iter()
-                .map(|g| <&str>::from(*g))
-                .collect::<Vec<_>>()
-                .join(", ")
-        )
-    }
-}
-
-/// Set the tool groups for one agent and persist the map. An empty
-/// `groups` vec removes the entry (agent reverts to role default).
-/// Returns an error if any name is not in `ToolGroup::ALL`, or if the
-/// existing file can't be read or parsed — the file is then left
-/// untouched.
-pub fn set_groups(name: &str, groups: &[String]) -> anyhow::Result<()> {
-    set_groups_at(&tool_groups_path(), name, groups)
-}
-
-fn set_groups_at(path: &Path, name: &str, groups: &[String]) -> anyhow::Result<()> {
-    if !groups.is_empty() {
-        validate_groups(groups)?;
-    }
-    let mut current: BTreeMap<String, Vec<String>> = super::read_map(path)?;
-    if groups.is_empty() {
-        current.remove(name);
-    } else {
-        current.insert(name.to_owned(), groups.to_vec());
-    }
-    super::write_map(path, &current).with_context(|| format!("write tool-groups for {name}"))
-}
-
-/// Drop the entry for an agent that is being destroyed. Idempotent.
-/// Fails without writing if the existing file can't be read or parsed.
-pub fn remove_agent(name: &str) -> std::io::Result<()> {
-    remove_agent_at(&tool_groups_path(), name)
-}
-
-fn remove_agent_at(path: &Path, name: &str) -> std::io::Result<()> {
-    let mut current: BTreeMap<String, Vec<String>> = super::read_map(path)?;
-    if current.remove(name).is_some() {
-        super::write_map(path, &current)?;
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    const TRUNCATED: &str = "{\n  \"alice\": [\"messaging\", \"meta\"],\n  \"bob\": [\"mess";
-
-    fn corrupt_file() -> (tempfile::TempDir, PathBuf) {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join(TOOL_GROUPS_FILE);
-        std::fs::write(&path, TRUNCATED).expect("seed");
-        (dir, path)
-    }
-
-    #[test]
-    fn set_groups_leaves_a_corrupt_file_untouched() {
-        let (_dir, path) = corrupt_file();
-        let err = set_groups_at(&path, "ruth", &["messaging".to_owned()])
-            .expect_err("a corrupt file must not be overwritten");
-        let kind = err
-            .downcast_ref::<std::io::Error>()
-            .map(std::io::Error::kind);
-        assert_eq!(kind, Some(std::io::ErrorKind::InvalidData));
-        assert_eq!(std::fs::read(&path).expect("read"), TRUNCATED.as_bytes());
-    }
-
-    #[test]
-    fn remove_agent_leaves_a_corrupt_file_untouched() {
-        let (_dir, path) = corrupt_file();
-        let err =
-            remove_agent_at(&path, "alice").expect_err("a corrupt file must not be overwritten");
-        assert_eq!(err.kind(), std::io::ErrorKind::InvalidData);
-        assert_eq!(std::fs::read(&path).expect("read"), TRUNCATED.as_bytes());
-    }
-
-    #[test]
-    fn set_groups_keeps_other_agents_entries() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join(TOOL_GROUPS_FILE);
-        set_groups_at(&path, "alice", &["inbox".to_owned()]).expect("set on missing file");
-        set_groups_at(&path, "ruth", &["messaging".to_owned()]).expect("set");
-        let map: BTreeMap<String, Vec<String>> =
-            crate::agent_config::read_map(&path).expect("read");
-        assert_eq!(map["alice"], vec!["inbox".to_owned()]);
-        assert_eq!(map["ruth"], vec!["messaging".to_owned()]);
-    }
-
-    #[test]
-    fn prune_unknown_keeps_known_name() {
-        let mut map = BTreeMap::from([("alice".to_owned(), vec!["messaging".to_owned()])]);
-        assert!(!prune_unknown(&mut map));
-        assert_eq!(map["alice"], vec!["messaging".to_owned()]);
-    }
-
-    #[test]
-    fn prune_unknown_keeps_a_hand_edited_differently_cased_known_name() {
-        let mut map = BTreeMap::from([("alice".to_owned(), vec!["Messaging".to_owned()])]);
-        assert!(!prune_unknown(&mut map));
-        assert_eq!(map["alice"], vec!["Messaging".to_owned()]);
-    }
-
-    #[test]
-    fn prune_unknown_drops_unrecognised_name() {
-        let mut map = BTreeMap::from([("alice".to_owned(), vec!["diagnostics".to_owned()])]);
-        assert!(prune_unknown(&mut map));
-        assert!(!map.contains_key("alice"));
-    }
-
-    #[test]
-    fn prune_unknown_keeps_known_and_drops_unknown_in_same_entry() {
-        let mut map = BTreeMap::from([(
-            "alice".to_owned(),
-            vec!["messaging".to_owned(), "scheduling".to_owned()],
-        )]);
-        assert!(prune_unknown(&mut map));
-        assert_eq!(map["alice"], vec!["messaging".to_owned()]);
-    }
-
-    #[test]
-    fn read_from_drops_an_unknown_name_still_on_disk_without_rewriting_the_file() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join(TOOL_GROUPS_FILE);
-        std::fs::write(&path, r#"{"alice": ["messaging", "diagnostics"]}"#).expect("seed");
-
-        // Exercises `read()`'s own wiring, not a hand-rolled equivalent —
-        // deleting the `prune_unknown` call inside `read_from` must fail
-        // this assertion.
-        let map = read_from(&path).expect("read_from");
-        assert_eq!(map["alice"], vec!["messaging".to_owned()]);
-
-        // `read()` itself never writes — the stale name is still on disk.
-        let on_disk = std::fs::read_to_string(&path).expect("read file");
-        assert!(on_disk.contains("diagnostics"), "{on_disk}");
-    }
-}
diff --git a/hive-c0re/src/agent_config/topology.rs b/hive-c0re/src/agent_config/topology.rs
index d12c297e..e7b13b84 100644
--- a/hive-c0re/src/agent_config/topology.rs
+++ b/hive-c0re/src/agent_config/topology.rs
@@ -9,11 +9,12 @@
 //! dashboard's tree view. All of that is gone; what the file is
 //! *for* now is the one thing that survived the removal — naming every
 //! agent, which is the set a
-//! [`hive_sh4re::permissions::Capability::ManageRootAgent`] holder gets
+//! [`hive_sh4re::permissions::Permission::ManageRootAgent`] holder gets
 //! bind-mounted ([`all_agents`]).
 //!
 //! Broader-than-your-own bind-mount grants are **not** stored here: they
-//! hang off the `ManageRootAgent` capability in `capabilities.json`. See
+//! hang off the `ManageRootAgent` permission the swarm grants
+//! (`swarm_permissions`). See
 //! `lifecycle::set_nspawn_flags`.
 
 use std::collections::BTreeSet;
@@ -64,8 +65,8 @@ fn read_from(path: &Path) -> std::io::Result<BTreeSet<String>> {
 }
 
 /// Every agent the roster knows about, in name order. This is the set
-/// a [`hive_sh4re::permissions::Capability::ManageRootAgent`] holder gets
-/// bind-mounted, and it is deliberately unfiltered: that capability means
+/// a [`hive_sh4re::permissions::Permission::ManageRootAgent`] holder gets
+/// bind-mounted, and it is deliberately unfiltered: that permission means
 /// "may manage any agent", so the set is all of them.
 ///
 /// An unreadable roster is logged and yields no agents, so the holder
diff --git a/hive-c0re/src/coordinator.rs b/hive-c0re/src/coordinator.rs
index 26815947..1592ed09 100644
--- a/hive-c0re/src/coordinator.rs
+++ b/hive-c0re/src/coordinator.rs
@@ -552,87 +552,6 @@ impl Coordinator {
         });
     }
 
-    /// Best-effort synchronous snapshot of live container names (the
-    /// logical agent names from the last `nixos-container list` scan).
-    /// Returns `None` when the roster cache lock is momentarily
-    /// contended. The async `containers_snapshot` is the reliable path
-    /// for request handlers; this exists for the sync SSE snapshot emits.
-    #[must_use]
-    pub fn live_container_names_blocking(&self) -> Option<HashSet<String>> {
-        self.last_containers
-            .try_lock()
-            .ok()
-            .map(|m| m.keys().cloned().collect())
-    }
-
-    /// Emit a `CapabilitiesChanged` snapshot event. Called from the
-    /// rebuild-queue worker after a `PermChange` / Capabilities entry
-    /// commits the JSON file, so the P3RM1SS10NS tab updates live.
-    pub fn emit_capabilities_snapshot(self: &Arc<Self>) {
-        use hive_sh4re::permissions::Capability;
-        let caps = Capability::ALL.iter().map(|c| <&str>::from(*c)).collect();
-        let descriptions = Capability::ALL
-            .iter()
-            .map(|c| (<&str>::from(*c), c.description()))
-            .collect();
-        // An empty snapshot would show every agent as having lost its
-        // capabilities; emit nothing and let the HTTP refetch report it.
-        let assignments = match crate::capabilities::read() {
-            Ok(map) => map,
-            Err(e) => {
-                tracing::warn!(error = ?e, "capabilities snapshot skipped");
-                return;
-            }
-        };
-        // Best-effort roster (sync path); on a contended cache miss we
-        // emit explicit keys only — the HTTP refetch fills the rest in.
-        let roster = self.live_container_names_blocking().unwrap_or_default();
-        // Capability default is "no extra caps" — empty default slice.
-        let (agents, effective) =
-            crate::dashboard::permissions::roster_and_effective(roster, &assignments, &[]);
-        self.emit_dashboard_event(DashboardEvent::CapabilitiesChanged {
-            seq: self.next_seq(),
-            caps,
-            descriptions,
-            assignments,
-            agents,
-            effective,
-        });
-    }
-
-    /// Emit a `ToolGroupsChanged` snapshot event. Called from the
-    /// rebuild-queue worker after a `PermChange` / `ToolGroups` entry
-    /// commits the JSON file, so the P3RM1SS10NS tab updates live.
-    pub fn emit_tool_groups_snapshot(self: &Arc<Self>) {
-        use hive_sh4re::permissions::ToolGroup;
-        let groups = ToolGroup::ALL.iter().map(|g| <&str>::from(*g)).collect();
-        let descriptions = ToolGroup::ALL
-            .iter()
-            .map(|g| (<&str>::from(*g), g.description()))
-            .collect();
-        let assignments = match crate::tool_groups::read() {
-            Ok(map) => map,
-            Err(e) => {
-                tracing::warn!(error = ?e, "tool-groups snapshot skipped");
-                return;
-            }
-        };
-        let roster = self.live_container_names_blocking().unwrap_or_default();
-        let (agents, effective) = crate::dashboard::permissions::roster_and_effective(
-            roster,
-            &assignments,
-            &crate::dashboard::permissions::tool_group_default_names(),
-        );
-        self.emit_dashboard_event(DashboardEvent::ToolGroupsChanged {
-            seq: self.next_seq(),
-            groups,
-            descriptions,
-            assignments,
-            agents,
-            effective,
-        });
-    }
-
     /// Subscribe to the shutdown watch channel. Background tasks call
     /// this at spawn time and break their loop when the receiver
     /// transitions to `true` (via `Coordinator::request_shutdown`).
diff --git a/hive-c0re/src/dashboard/mod.rs b/hive-c0re/src/dashboard/mod.rs
index 6f1fec8d..b5234a37 100644
--- a/hive-c0re/src/dashboard/mod.rs
+++ b/hive-c0re/src/dashboard/mod.rs
@@ -37,7 +37,6 @@ use crate::lifecycle;
         (name = "lifecycle_ops", description = "agent container lifecycle: rebuild/restart/start/stop/pause/limits"),
         (name = "meta_inputs", description = "bulk flake-input update for the meta flake"),
         (name = "misc_api", description = "mark-all-read, compose, spawn-request, hive stats"),
-        (name = "permissions", description = "tool-group + capability assignment for agents"),
         (name = "rebuild_queue", description = "rebuild-queue cancel"),
         (name = "state_files", description = "proxied reads of allow-listed per-agent state files"),
         (name = "state_snapshot", description = "cold-load dashboard snapshot"),
@@ -56,7 +55,6 @@ mod health;
 mod lifecycle_ops;
 mod meta_inputs;
 mod misc_api;
-pub(crate) mod permissions;
 mod rebuild_queue;
 mod state_files;
 mod state_snapshot;
@@ -124,13 +122,6 @@ fn app(coord: Arc<Coordinator>) -> axum::Router {
         .routes(routes!(build_logs::get_build_logs_agent))
         .routes(routes!(build_logs::get_build_log_full))
         .routes(routes!(build_logs::get_build_log_raw))
-        .routes(routes!(permissions::get_tool_groups))
-        .routes(routes!(permissions::post_tool_groups))
-        .routes(routes!(permissions::get_capabilities))
-        .routes(routes!(permissions::post_capabilities))
-        .routes(routes!(permissions::post_permissions))
-        .routes(routes!(permissions::get_stale_permissions))
-        .routes(routes!(permissions::delete_agent_permissions))
         .routes(routes!(rebuild_queue::post_rebuild_queue_cancel))
         .routes(routes!(lifecycle_ops::post_destroy))
         .routes(routes!(lifecycle_ops::post_kill))
@@ -378,13 +369,6 @@ mod router_build_probe {
             .routes(routes!(build_logs::get_build_logs_agent))
             .routes(routes!(build_logs::get_build_log_full))
             .routes(routes!(build_logs::get_build_log_raw))
-            .routes(routes!(permissions::get_tool_groups))
-            .routes(routes!(permissions::post_tool_groups))
-            .routes(routes!(permissions::get_capabilities))
-            .routes(routes!(permissions::post_capabilities))
-            .routes(routes!(permissions::post_permissions))
-            .routes(routes!(permissions::get_stale_permissions))
-            .routes(routes!(permissions::delete_agent_permissions))
             .routes(routes!(rebuild_queue::post_rebuild_queue_cancel))
             .routes(routes!(lifecycle_ops::post_destroy))
             .routes(routes!(lifecycle_ops::post_kill))
diff --git a/hive-c0re/src/dashboard/permissions.rs b/hive-c0re/src/dashboard/permissions.rs
deleted file mode 100644
index 0ec25b05..00000000
--- a/hive-c0re/src/dashboard/permissions.rs
+++ /dev/null
@@ -1,567 +0,0 @@
-//! Tool-group + capability permission endpoints for the dashboard.
-//!
-//! Read endpoints return the full set of known groups/capabilities plus
-//! descriptions and the per-agent assignment map (the UI never hard-codes
-//! the lists). Write endpoints validate, then enqueue a `PermChange` so the
-//! JSON file write is serialised through the FIFO rebuild worker.
-
-use axum::{
-    extract::{Path as AxumPath, State},
-    http::StatusCode,
-    response::{IntoResponse, Response},
-};
-use serde::{Deserialize, Serialize};
-use utoipa::ToSchema;
-
-use problem_details::ProblemDetails;
-
-use super::{AppState, Ident, guard_agent_name, strip_container_prefix};
-
-#[derive(Serialize, ToSchema)]
-pub(super) struct ToolGroupsSnapshot {
-    /// Ordered list of all known tool-group names. Drives the column
-    /// headers in the capabilities table — the UI does not hard-code them.
-    groups: Vec<&'static str>,
-    /// Short description for each group name. Keys match `groups` entries.
-    descriptions: std::collections::BTreeMap<&'static str, &'static str>,
-    /// Per-agent *explicit* assignment map. Absent agents use the role
-    /// default — the UI uses presence here to badge an agent "(default)".
-    assignments: std::collections::BTreeMap<String, Vec<String>>,
-    /// Every agent the operator can manage (live roster ∪ explicit keys),
-    /// sorted. The UI lists rows from this so default-perms agents always
-    /// appear without depending on a separately-loaded container list.
-    agents: Vec<String>,
-    /// Per-agent *effective* groups: the explicit entry when present, else
-    /// the role default the harness actually applies. Drives the checkbox
-    /// state so default agents show their real groups, not blank.
-    effective: std::collections::BTreeMap<String, Vec<String>>,
-}
-
-/// Every known tool-group name + description,
-/// plus the per-agent explicit/effective assignment maps.
-#[utoipa::path(
-    get,
-    path = "/api/tool-groups",
-    responses(
-        (status = 200, description = "tool-group catalogue + assignments", body = ToolGroupsSnapshot),
-        (status = 500, description = "tool-groups file unreadable"),
-    ),
-    tag = "permissions"
-)]
-pub(super) async fn get_tool_groups(
-    State(state): State<AppState>,
-) -> Result<axum::Json<ToolGroupsSnapshot>, ProblemDetails> {
-    let groups = hive_sh4re::permissions::ToolGroup::ALL
-        .iter()
-        .map(|g| <&str>::from(*g))
-        .collect();
-    let descriptions = hive_sh4re::permissions::ToolGroup::ALL
-        .iter()
-        .map(|g| (<&str>::from(*g), g.description()))
-        .collect();
-    let assignments = crate::tool_groups::read().map_err(|e| unreadable(&e))?;
-    let roster = state
-        .coord
-        .containers_snapshot()
-        .await
-        .into_iter()
-        .map(|c| c.name);
-    let (agents, effective) =
-        roster_and_effective(roster, &assignments, &tool_group_default_names());
-    Ok(axum::Json(ToolGroupsSnapshot {
-        groups,
-        descriptions,
-        assignments,
-        agents,
-        effective,
-    }))
-}
-
-/// A permission file that exists but can't be read or parsed. Surfaced
-/// as a 500 rather than an empty table, which would read as "nobody has
-/// any grants".
-fn unreadable(e: &std::io::Error) -> ProblemDetails {
-    ProblemDetails::from_status_code(StatusCode::INTERNAL_SERVER_ERROR).with_detail(e.to_string())
-}
-
-/// The role-default tool-group names the harness falls back to for an
-/// agent with no explicit entry (`ToolGroup::AGENT_DEFAULT`). Shared by
-/// the HTTP snapshot and the SSE emit so the effective values match what
-/// the container actually runs with.
-#[must_use]
-pub(crate) fn tool_group_default_names() -> Vec<&'static str> {
-    hive_sh4re::permissions::ToolGroup::AGENT_DEFAULT
-        .iter()
-        .map(|g| <&str>::from(*g))
-        .collect()
-}
-
-/// Build the `(agents, effective)` pair for a permissions snapshot.
-/// `agents` is the sorted union of the live roster and any agent that
-/// already has an explicit entry; `effective[agent]` is the explicit
-/// assignment when present, else `default` (the role fallback). Shared by
-/// the capabilities + tool-groups snapshots on both the HTTP and SSE
-/// paths so the two surfaces never drift.
-#[must_use]
-pub(crate) fn roster_and_effective(
-    roster: impl IntoIterator<Item = String>,
-    explicit: &std::collections::BTreeMap<String, Vec<String>>,
-    default: &[&'static str],
-) -> (Vec<String>, std::collections::BTreeMap<String, Vec<String>>) {
-    let mut names: std::collections::BTreeSet<String> = roster.into_iter().collect();
-    names.extend(explicit.keys().cloned());
-    let agents: Vec<String> = names.into_iter().collect();
-    let effective = agents
-        .iter()
-        .map(|a| {
-            let v = explicit
-                .get(a)
-                .cloned()
-                .unwrap_or_else(|| default.iter().map(|s| (*s).to_owned()).collect::<Vec<_>>());
-            (a.clone(), v)
-        })
-        .collect();
-    (agents, effective)
-}
-
-#[derive(Deserialize, ToSchema)]
-pub(super) struct SetToolGroupsBody {
-    groups: Vec<String>,
-}
-
-/// Replace `agent`'s explicit tool-group
-/// assignment (JSON body `{"groups": [...]}`).
-#[utoipa::path(
-    post,
-    path = "/api/tool-groups/{agent}",
-    params(("agent" = String, Path, description = "agent name")),
-    request_body = SetToolGroupsBody,
-    responses(
-        (status = 200, description = "tool-groups queued for write", body = String),
-        (status = 400, description = "unknown group name, or no such agent"),
-        (status = 404, description = "no such agent"),
-    ),
-    tag = "permissions"
-)]
-pub(super) async fn post_tool_groups(
-    State(state): State<AppState>,
-    AxumPath(name): AxumPath<String>,
-    axum::Json(body): axum::Json<SetToolGroupsBody>,
-) -> Result<Response, ProblemDetails> {
-    let logical = strip_container_prefix(&name);
-    // `guard_agent_name` yields a ready-made rejection `Response`; pass it
-    // through as `Ok` (axum sends it verbatim) rather than re-deriving a
-    // `ProblemDetails` — the guard is shared with `-> Response` handlers.
-    if let Some(reject) = guard_agent_name(&state, &logical).await {
-        return Ok(reject);
-    }
-    // Validate group names before queuing — fail fast so the operator
-    // sees the error immediately rather than waiting for the worker.
-    if let Err(e) = crate::tool_groups::validate_groups(&body.groups) {
-        return Err(ProblemDetails::from_status_code(StatusCode::BAD_REQUEST)
-            .with_detail(format!("invalid tool-groups for {logical}: {e}")));
-    }
-    // Submit a PermChange DAG: the JSON file write commits under
-    // META_LOCK inside the WritePermFile node, so concurrent
-    // batch-apply actions for different agents never race on the
-    // shared tool-groups.json.
-    state
-        .coord
-        .job_queue
-        .insert_job(|b| {
-            crate::job_queue::templates::perm_change(
-                b,
-                &logical,
-                crate::job_queue::PermPayload::ToolGroups {
-                    groups: body.groups.clone(),
-                },
-            );
-            Vec::new()
-        })
-        .expect("template-declared shapes are acyclic");
-    state.coord.emit_rebuild_queue_snapshot();
-    tracing::info!(agent = %logical, groups = ?body.groups, "operator: set tool-groups via dashboard");
-    Ok((StatusCode::OK, "ok").into_response())
-}
-
-#[derive(Serialize, ToSchema)]
-pub(super) struct CapabilitiesSnapshot {
-    /// Ordered list of all known capability names. Drives the column
-    /// headers in the capabilities table — the UI does not hard-code them.
-    caps: Vec<&'static str>,
-    /// Short description for each capability name. Keys match `caps` entries.
-    descriptions: std::collections::BTreeMap<&'static str, &'static str>,
-    /// Per-agent *explicit* capability grant map. Absent agents have no
-    /// extra caps — the UI uses presence here to badge "(default)".
-    assignments: std::collections::BTreeMap<String, Vec<String>>,
-    /// Every agent the operator can manage (live roster ∪ explicit keys),
-    /// sorted — so default agents always list.
-    agents: Vec<String>,
-    /// Per-agent *effective* caps: explicit entry when present, else the
-    /// default (no caps). Keeps the snapshot shape symmetric with
-    /// tool-groups; the default here is always empty.
-    effective: std::collections::BTreeMap<String, Vec<String>>,
-}
-
-/// Every known capability name + description,
-/// plus the per-agent explicit/effective grant maps.
-#[utoipa::path(
-    get,
-    path = "/api/capabilities",
-    responses(
-        (status = 200, description = "capability catalogue + assignments", body = CapabilitiesSnapshot),
-        (status = 500, description = "capabilities file unreadable"),
-    ),
-    tag = "permissions"
-)]
-pub(super) async fn get_capabilities(
-    State(state): State<AppState>,
-) -> Result<axum::Json<CapabilitiesSnapshot>, ProblemDetails> {
-    use hive_sh4re::permissions::Capability;
-    let caps = Capability::ALL.iter().map(|c| <&str>::from(*c)).collect();
-    let descriptions = Capability::ALL
-        .iter()
-        .map(|c| (<&str>::from(*c), c.description()))
-        .collect();
-    let assignments = crate::capabilities::read().map_err(|e| unreadable(&e))?;
-    let roster = state
-        .coord
-        .containers_snapshot()
-        .await
-        .into_iter()
-        .map(|c| c.name);
-    // Capability default is "no extra caps" — empty default slice.
-    let (agents, effective) = roster_and_effective(roster, &assignments, &[]);
-    Ok(axum::Json(CapabilitiesSnapshot {
-        caps,
-        descriptions,
-        assignments,
-        agents,
-        effective,
-    }))
-}
-
-#[derive(Deserialize, ToSchema)]
-pub(super) struct SetCapabilitiesBody {
-    caps: Vec<String>,
-}
-
-/// Replace `agent`'s explicit capability
-/// grant set (JSON body `{"caps": [...]}`).
-#[utoipa::path(
-    post,
-    path = "/api/capabilities/{agent}",
-    params(("agent" = String, Path, description = "agent name")),
-    request_body = SetCapabilitiesBody,
-    responses(
-        (status = 200, description = "capabilities queued for write", body = String),
-        (status = 400, description = "unknown capability name"),
-        (status = 404, description = "no such agent"),
-    ),
-    tag = "permissions"
-)]
-pub(super) async fn post_capabilities(
-    State(state): State<AppState>,
-    AxumPath(name): AxumPath<String>,
-    axum::Json(body): axum::Json<SetCapabilitiesBody>,
-) -> Result<Response, ProblemDetails> {
-    let logical = strip_container_prefix(&name);
-    if let Some(reject) = guard_agent_name(&state, &logical).await {
-        return Ok(reject);
-    }
-    let known: Vec<&str> = hive_sh4re::permissions::Capability::ALL
-        .iter()
-        .map(|c| <&str>::from(*c))
-        .collect();
-    for cap in &body.caps {
-        if !known.contains(&cap.as_str()) {
-            return Err(ProblemDetails::from_status_code(StatusCode::BAD_REQUEST)
-                .with_detail(format!("unknown capability: {cap}")));
-        }
-    }
-    // Submit a PermChange DAG: the JSON file write commits under
-    // META_LOCK inside the WritePermFile node, so concurrent
-    // batch-apply actions for different agents never race on the
-    // shared capabilities.json.
-    state
-        .coord
-        .job_queue
-        .insert_job(|b| {
-            crate::job_queue::templates::perm_change(
-                b,
-                &logical,
-                crate::job_queue::PermPayload::Capabilities {
-                    caps: body.caps.clone(),
-                },
-            );
-            Vec::new()
-        })
-        .expect("template-declared shapes are acyclic");
-    state.coord.emit_rebuild_queue_snapshot();
-    tracing::info!(agent = %logical, caps = ?body.caps, "operator: set capabilities via dashboard");
-    Ok((StatusCode::OK, "ok").into_response())
-}
-
-/// One agent's slice of a batch permission change. Sparse: an omitted
-/// field leaves that perm-type untouched, an empty array clears it, a
-/// populated array fully replaces it (same replace semantics as the
-/// per-agent endpoints).
-#[derive(Deserialize, ToSchema)]
-pub(super) struct PermChangeBody {
-    agent: String,
-    #[serde(default)]
-    tool_groups: Option<Vec<String>>,
-    #[serde(default)]
-    capabilities: Option<Vec<String>>,
-}
-
-#[derive(Deserialize, ToSchema)]
-pub(super) struct BatchPermsBody {
-    changes: Vec<PermChangeBody>,
-}
-
-/// A validated, non-empty change staged for enqueue:
-/// `(logical agent, new groups?, new caps?)`.
-type StagedPerm = (String, Option<Vec<String>>, Option<Vec<String>>);
-
-/// Batch permission apply — `POST /api/permissions`.
-///
-/// The save-all permissions UI sends only the perm-types that actually
-/// changed per agent; each affected agent gets ONE combined
-/// `PermChange`, so the dedup key collapses to `(kind, agent)` and an
-/// agent whose caps AND groups both changed rebuilds once, not twice.
-/// The whole batch is atomic: every change is validated up front and
-/// on any validation error nothing is written or enqueued.
-#[utoipa::path(
-    post,
-    path = "/api/permissions",
-    request_body = BatchPermsBody,
-    responses(
-        (status = 200, description = "batch permission change queued", body = String),
-        (status = 400, description = "unknown tool-group/capability name, or no such agent"),
-        (status = 404, description = "no such agent"),
-    ),
-    tag = "permissions"
-)]
-pub(super) async fn post_permissions(
-    State(state): State<AppState>,
-    axum::Json(body): axum::Json<BatchPermsBody>,
-) -> Result<Response, ProblemDetails> {
-    let known_caps: Vec<&str> = hive_sh4re::permissions::Capability::ALL
-        .iter()
-        .map(|c| <&str>::from(*c))
-        .collect();
-    // Phase 1 — validate everything before touching any file or the
-    // queue, so a bad entry fails the whole POST with zero side effects.
-    // No-op rows (both fields omitted) are skipped, not errors.
-    let mut staged: Vec<StagedPerm> = Vec::new();
-    for change in &body.changes {
-        let logical = strip_container_prefix(&change.agent);
-        if let Some(reject) = guard_agent_name(&state, &logical).await {
-            return Ok(reject);
-        }
-        if let Some(groups) = &change.tool_groups
-            && let Err(e) = crate::tool_groups::validate_groups(groups)
-        {
-            return Err(ProblemDetails::from_status_code(StatusCode::BAD_REQUEST)
-                .with_detail(format!("invalid tool-groups for {logical}: {e}")));
-        }
-        if let Some(caps) = &change.capabilities {
-            for cap in caps {
-                if !known_caps.contains(&cap.as_str()) {
-                    return Err(ProblemDetails::from_status_code(StatusCode::BAD_REQUEST)
-                        .with_detail(format!("unknown capability for {logical}: {cap}")));
-                }
-            }
-        }
-        if change.tool_groups.is_some() || change.capabilities.is_some() {
-            staged.push((
-                logical,
-                change.tool_groups.clone(),
-                change.capabilities.clone(),
-            ));
-        }
-    }
-    // Phase 2 — submit one combined PermChange DAG per affected agent.
-    for (logical, groups, caps) in staged {
-        state
-            .coord
-            .job_queue
-            .insert_job(|b| {
-                crate::job_queue::templates::perm_change(
-                    b,
-                    &logical,
-                    crate::job_queue::PermPayload::Combined { groups, caps },
-                );
-                Vec::new()
-            })
-            .expect("template-declared shapes are acyclic");
-        state.coord.emit_rebuild_queue_snapshot();
-        tracing::info!(agent = %logical, "operator: batch perm change via dashboard");
-    }
-    Ok((StatusCode::OK, "ok").into_response())
-}
-
-/// Agent names that have explicit capability/tool-group entries but are
-/// not in the live container roster AND not in the kept-state directory
-/// list (i.e. truly gone — renamed or destroyed agents whose JSON entries
-/// persisted). The client uses this to drive the "stale permission entries"
-/// sub-section in K3PT ST4T3 without having to fetch three separate
-/// endpoints and perform set arithmetic on the client side.
-#[derive(Serialize, ToSchema)]
-pub(super) struct StalePermsResponse {
-    /// Ghost agent names, sorted. Empty list → no stale entries.
-    stale: Vec<String>,
-}
-
-/// Agent names with explicit permission
-/// entries but no matching live container or kept-state dir.
-#[utoipa::path(
-    get,
-    path = "/api/permissions/stale",
-    responses(
-        (status = 200, description = "ghost agent names with stale permission entries", body = StalePermsResponse),
-        (status = 500, description = "tool-groups/capabilities file unreadable"),
-    ),
-    tag = "permissions"
-)]
-pub(super) async fn get_stale_permissions(
-    State(state): State<AppState>,
-) -> Result<axum::Json<StalePermsResponse>, ProblemDetails> {
-    // Live container names — includes stopped-but-configured containers.
-    let live: std::collections::HashSet<String> = state
-        .coord
-        .containers_snapshot()
-        .await
-        .into_iter()
-        .map(|c| c.name)
-        .collect();
-    // Kept-state directories: every agent that ever had a state dir on disk,
-    // including both live containers (already in `live`) and soft-deleted
-    // tombstones (destroyed but kept). A name present here is either live
-    // or a properly-removed tombstone — neither is a ghost.
-    let kept: std::collections::HashSet<String> =
-        crate::coordinator::Coordinator::kept_state_names()
-            .into_iter()
-            .map(hive_types::Ident::into_string)
-            .collect();
-    // Known = live roster ∪ kept-state names.
-    let known: std::collections::HashSet<&String> = live.iter().chain(kept.iter()).collect();
-    // Explicit entries in either JSON file.
-    let caps = crate::capabilities::read().map_err(|e| unreadable(&e))?;
-    let tgs = crate::tool_groups::read().map_err(|e| unreadable(&e))?;
-    let mut ghost_names: Vec<String> = caps
-        .keys()
-        .chain(tgs.keys())
-        .filter(|n| !known.contains(n))
-        .cloned()
-        .collect::<std::collections::HashSet<_>>()
-        .into_iter()
-        .collect();
-    ghost_names.sort();
-    Ok(axum::Json(StalePermsResponse { stale: ghost_names }))
-}
-
-/// Clear all explicit permission entries for a named agent without
-/// requiring it to exist in the live roster.
-///
-/// Used by the P3RM1SS10NS tab's "remove" button for agents that have
-/// stale explicit entries in `tool-groups.json` / `capabilities.json`
-/// but are no longer running (e.g. an agent that was renamed or
-/// destroyed while its JSON entries persisted).
-///
-/// Bypasses `guard_agent_name`'s live-roster check intentionally —
-/// the whole point is to remove entries for non-roster agents. Only
-/// the format check ([`Ident::parse`]) is applied. No rebuild is
-/// enqueued (the agent doesn't exist to rebuild); the SSE snapshots
-/// update the P3RM1SS10NS tab live.
-#[utoipa::path(
-    delete,
-    path = "/api/permissions/{agent}",
-    params(("agent" = String, Path, description = "agent name (need not be live)")),
-    responses(
-        (status = 200, description = "stale permission entries cleared", body = String),
-        (status = 400, description = "bad agent name"),
-        (status = 500, description = "tool-groups/capabilities file write failed"),
-    ),
-    tag = "permissions"
-)]
-pub(super) async fn delete_agent_permissions(
-    State(state): State<AppState>,
-    AxumPath(name): AxumPath<String>,
-) -> Response {
-    let logical = match Ident::parse(&strip_container_prefix(&name)) {
-        Ok(n) => n,
-        Err(reason) => {
-            return (StatusCode::BAD_REQUEST, format!("bad agent name: {reason}")).into_response();
-        }
-    };
-    // Run both removals regardless so we clean up as much as possible
-    // even on partial I/O errors. Collect errors to surface below.
-    let tg_err = crate::tool_groups::remove_agent(logical.as_str()).err();
-    if let Some(ref e) = tg_err {
-        tracing::warn!(agent = %logical, error = ?e, "failed to remove tool-groups entry");
-    }
-    let cap_err = crate::capabilities::remove_agent(logical.as_str()).err();
-    if let Some(ref e) = cap_err {
-        tracing::warn!(agent = %logical, error = ?e, "failed to remove capabilities entry");
-    }
-    // Emit live snapshots even on partial failure so the UI stays as
-    // accurate as possible — the surviving table gets updated immediately.
-    state.coord.emit_tool_groups_snapshot();
-    state.coord.emit_capabilities_snapshot();
-    // Surface any I/O error as 500 so the frontend's `!resp.ok` path
-    // fires and the operator sees a meaningful message rather than a
-    // silent "success" followed by the row reappearing unchanged.
-    if let Some(e) = tg_err.or(cap_err) {
-        return (
-            StatusCode::INTERNAL_SERVER_ERROR,
-            format!("failed to remove permission entries for {logical}: {e}"),
-        )
-            .into_response();
-    }
-    tracing::info!(agent = %logical, "operator: cleared stale permission entries via dashboard");
-    (StatusCode::OK, "ok").into_response()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::roster_and_effective;
-    use std::collections::BTreeMap;
-
-    #[test]
-    fn effective_unions_roster_and_explicit_and_applies_default() {
-        let mut explicit: BTreeMap<String, Vec<String>> = BTreeMap::new();
-        explicit.insert("iris".to_owned(), vec!["messaging".to_owned()]);
-        // `ruth` has an explicit entry but isn't in the live roster (e.g.
-        // momentarily not listed) — it must still appear and keep its
-        // explicit value.
-        explicit.insert(
-            "ruth".to_owned(),
-            vec!["messaging".to_owned(), "lifecycle".to_owned()],
-        );
-        let roster = ["damocles".to_owned(), "iris".to_owned()];
-        let default = ["messaging", "meta", "inbox", "execution"];
-
-        let (agents, effective) = roster_and_effective(roster, &explicit, &default);
-
-        // Sorted union of roster + explicit keys.
-        assert_eq!(agents, vec!["damocles", "iris", "ruth"]);
-        // Entry-less agent (damocles) → role default.
-        assert_eq!(
-            effective["damocles"],
-            vec!["messaging", "meta", "inbox", "execution"]
-        );
-        // Explicit entries kept verbatim.
-        assert_eq!(effective["iris"], vec!["messaging"]);
-        assert_eq!(effective["ruth"], vec!["messaging", "lifecycle"]);
-    }
-
-    #[test]
-    fn empty_default_yields_empty_effective_for_entryless() {
-        let explicit: BTreeMap<String, Vec<String>> = BTreeMap::new();
-        let (agents, effective) = roster_and_effective(["atlas".to_owned()], &explicit, &[]);
-        assert_eq!(agents, vec!["atlas"]);
-        assert!(effective["atlas"].is_empty());
-    }
-}
diff --git a/hive-c0re/src/dashboard_events.rs b/hive-c0re/src/dashboard_events.rs
index 7cfd5804..8327adc2 100644
--- a/hive-c0re/src/dashboard_events.rs
+++ b/hive-c0re/src/dashboard_events.rs
@@ -141,42 +141,6 @@ pub enum DashboardEvent {
     /// (transients, container state), and a poll loop would be
     /// slower for the same information.
     RebuildQueueChanged { seq: u64 },
-    /// Full snapshot of capability grants (per-agent `Vec<cap_name>`).
-    /// Emitted from the rebuild-queue worker after a `PermChange`
-    /// `Capabilities` entry commits the JSON file. Lets the P3RM1SS10NS
-    /// tab update live when the worker applies a queued change.
-    CapabilitiesChanged {
-        seq: u64,
-        /// Ordered list of all known capability names (column headers).
-        caps: Vec<&'static str>,
-        /// Short description for each capability name (tooltip).
-        descriptions: std::collections::BTreeMap<&'static str, &'static str>,
-        /// Per-agent *explicit* capability grant map; absent agents have
-        /// no extra caps (the UI badges those "(default)").
-        assignments: std::collections::BTreeMap<String, Vec<String>>,
-        /// Sorted roster the operator can manage (live ∪ explicit keys).
-        agents: Vec<String>,
-        /// Per-agent *effective* caps (explicit-or-default; default empty).
-        effective: std::collections::BTreeMap<String, Vec<String>>,
-    },
-    /// Full snapshot of tool-group assignments (per-agent `Vec<group_name>`).
-    /// Emitted from the rebuild-queue worker after a `PermChange`
-    /// `ToolGroups` entry commits the JSON file. Lets the P3RM1SS10NS
-    /// tab update live when the worker applies a queued change.
-    ToolGroupsChanged {
-        seq: u64,
-        /// Ordered list of all known tool-group names (column headers).
-        groups: Vec<&'static str>,
-        /// Short description for each group name (tooltip).
-        descriptions: std::collections::BTreeMap<&'static str, &'static str>,
-        /// Per-agent *explicit* assignment map; absent agents use the role
-        /// default (the UI badges those "(default)").
-        assignments: std::collections::BTreeMap<String, Vec<String>>,
-        /// Sorted roster the operator can manage (live ∪ explicit keys).
-        agents: Vec<String>,
-        /// Per-agent *effective* groups (explicit-or-`AGENT_DEFAULT`).
-        effective: std::collections::BTreeMap<String, Vec<String>>,
-    },
 }
 
 impl DashboardEvent {
@@ -203,8 +167,6 @@ impl DashboardEvent {
             DashboardEvent::MetaInputsChanged { .. } => "meta_inputs_changed",
             DashboardEvent::MetaUpdateRunning { .. } => "meta_update_running",
             DashboardEvent::RebuildQueueChanged { .. } => "rebuild_queue_changed",
-            DashboardEvent::CapabilitiesChanged { .. } => "capabilities_changed",
-            DashboardEvent::ToolGroupsChanged { .. } => "tool_groups_changed",
         }
     }
 }
@@ -279,22 +241,6 @@ mod tests {
                 running: false,
             },
             DashboardEvent::RebuildQueueChanged { seq: 1 },
-            DashboardEvent::CapabilitiesChanged {
-                seq: 1,
-                caps: Vec::new(),
-                descriptions: std::collections::BTreeMap::new(),
-                assignments: std::collections::BTreeMap::new(),
-                agents: Vec::new(),
-                effective: std::collections::BTreeMap::new(),
-            },
-            DashboardEvent::ToolGroupsChanged {
-                seq: 1,
-                groups: Vec::new(),
-                descriptions: std::collections::BTreeMap::new(),
-                assignments: std::collections::BTreeMap::new(),
-                agents: Vec::new(),
-                effective: std::collections::BTreeMap::new(),
-            },
         ];
         for ev in samples {
             let v: serde_json::Value = serde_json::to_value(&ev).expect("serialise");
diff --git a/hive-c0re/src/job_queue/exec.rs b/hive-c0re/src/job_queue/exec.rs
index f924aa28..30c2b525 100644
--- a/hive-c0re/src/job_queue/exec.rs
+++ b/hive-c0re/src/job_queue/exec.rs
@@ -120,7 +120,6 @@ pub(super) async fn run_node(
         // The payload rides the node and is destructured here, so the executor
         // takes it directly instead of re-matching the kind behind a `bail!`
         // that could never fire.
-        NodeKind::WritePermFile { payload, .. } => run_write_perm_file(coord, agent, payload).await,
         NodeKind::EmitRebuilt { ok, .. } => {
             run_emit_rebuilt(coord, agent, coord.job_queue.root_of(id), *ok).await;
             Ok(())
@@ -790,47 +789,6 @@ async fn run_write_dropin(coord: &Arc<Coordinator>, name: &str) -> Result<()> {
     Ok(())
 }
 
-/// Write + commit the perm file(s) (fused under `META_LOCK` so the
-/// working tree is never left dirty), then emit the P3RM1SS10NS-tab
-/// snapshots so the dashboard reflects the new assignment.
-async fn run_write_perm_file(
-    coord: &Arc<Coordinator>,
-    name: &str,
-    payload: &super::model::PermPayload,
-) -> Result<()> {
-    use super::model::PermPayload;
-    // Runs under the deploy window (it declares `Resource::MetaWindow`): a
-    // perm commit landing inside another node's staged prepare→finalize
-    // window would sweep the staged deploy lock into its commit (the
-    // commits are also path-limited in meta.rs — belt and braces).
-    match payload {
-        PermPayload::ToolGroups { groups } => {
-            crate::meta::commit_tool_groups(name, groups)
-                .await
-                .with_context(|| format!("commit tool-groups for {name}"))?;
-            coord.emit_tool_groups_snapshot();
-        }
-        PermPayload::Capabilities { caps } => {
-            crate::meta::commit_capabilities(name, caps)
-                .await
-                .with_context(|| format!("commit capabilities for {name}"))?;
-            coord.emit_capabilities_snapshot();
-        }
-        PermPayload::Combined { groups, caps } => {
-            crate::meta::commit_perms(name, groups.as_deref(), caps.as_deref())
-                .await
-                .with_context(|| format!("commit perms for {name}"))?;
-            if groups.is_some() {
-                coord.emit_tool_groups_snapshot();
-            }
-            if caps.is_some() {
-                coord.emit_capabilities_snapshot();
-            }
-        }
-    }
-    Ok(())
-}
-
 /// Compute which agents a `nix flake update <inputs>` on the meta
 /// flake affects — the fan-out set for `MetaUpdate` DAGs. Empty
 /// `inputs` or any input under `hyperhive` → every container;
diff --git a/hive-c0re/src/job_queue/mod.rs b/hive-c0re/src/job_queue/mod.rs
index cce7adb6..65caafe4 100644
--- a/hive-c0re/src/job_queue/mod.rs
+++ b/hive-c0re/src/job_queue/mod.rs
@@ -43,7 +43,7 @@ use hive_jobq::{Graph, NodeId};
 use hive_jobq_wire::{GraphNode, GraphWire};
 use tokio::sync::Notify;
 
-pub use model::{NodeKind, PermPayload, State};
+pub use model::{NodeKind, State};
 use resource::Resource;
 
 /// A job under construction: `hive_jobq`'s builder over this queue's payload
diff --git a/hive-c0re/src/job_queue/model.rs b/hive-c0re/src/job_queue/model.rs
index 33e0ce87..52c89edd 100644
--- a/hive-c0re/src/job_queue/model.rs
+++ b/hive-c0re/src/job_queue/model.rs
@@ -1,7 +1,7 @@
 //! Data model for the generic job-DAG queue: the node kinds — the primitive
-//! operations — and what each one carries. The `State` / `PermPayload` wire
-//! enums live in `hive_host_sock::jobs` (they travel on the host admin
-//! socket) and are re-exported here for the queue's internal use. The graph
+//! operations — and what each one carries. The `State` wire
+//! enum lives in `hive_host_sock::jobs` (it travels on the host admin
+//! socket) and is re-exported here for the queue's internal use. The graph
 //! itself is served through `hive_jobq_wire`'s generic projection — there is
 //! no second, typed view of it any more.
 //!
@@ -12,7 +12,7 @@
 //! job is exactly the nodes it declared. See `docs/scheduler/coordinator.md::Job queue`
 //! for the full design.
 
-pub use hive_host_sock::jobs::{PermPayload, State};
+pub use hive_host_sock::jobs::State;
 use serde::Serialize;
 
 /// The primitive operations — each kind maps to one executor fn in
@@ -98,12 +98,10 @@ pub enum NodeKind {
     PauseDrain { agent: String },
     /// `set_nspawn_flags` + `set_resource_limits` + daemon-reload.
     WriteDropin { agent: String },
-    /// Commit `tool-groups.json` / `capabilities.json` per its `payload`.
-    WritePermFile { agent: String, payload: PermPayload },
     /// Group root of a rebuild subtree — the **brace**, scoped to one
     /// agent. Why braces exist and what they cost: _Braces_.
     AgentWindow { agent: String },
-    /// Tail node of a rebuild / perm-change: emit this agent's `Rebuilt`
+    /// Tail node of a rebuild: emit this agent's `Rebuilt`
     /// manager event. One node per agent *and* per outcome; no cancel
     /// variant (a cancelled DAG never ran, so there is no rebuild to
     /// report).
@@ -185,7 +183,6 @@ impl NodeKind {
             | NodeKind::PauseSignal { agent }
             | NodeKind::PauseDrain { agent }
             | NodeKind::WriteDropin { agent }
-            | NodeKind::WritePermFile { agent, .. }
             | NodeKind::AgentWindow { agent }
             | NodeKind::EmitRebuilt { agent, .. }
             | NodeKind::SetWanted { agent, .. } => agent,
diff --git a/hive-c0re/src/job_queue/templates.rs b/hive-c0re/src/job_queue/templates.rs
index b7d4e7e4..03baf81a 100644
--- a/hive-c0re/src/job_queue/templates.rs
+++ b/hive-c0re/src/job_queue/templates.rs
@@ -20,7 +20,7 @@
 //! `lifecycle::is_running` read), so [`super::power`] assembles them out of
 //! the primitives this module exports ([`rebuild_nodes`]).
 
-use super::model::{NodeKind, PermPayload};
+use super::model::NodeKind;
 use super::resource::Resource;
 use super::{Handle, JobBuilder};
 
@@ -403,26 +403,6 @@ pub fn destroy(builder: &JobBuilder, agent: &str, purge: bool) {
         .after_ok(last);
 }
 
-/// Perm change: commit the JSON file(s), then the rebuild subgraph so
-/// the updated `HIVE_TOOL_GROUPS` / `HIVE_CAPABILITIES` env var takes
-/// effect in the container. Group-roots are `WritePermFile` plus the rebuild
-/// subgraph's `MetaSync` / `Prebuild` / `Reconcile`, so the `EmitRebuilt` tail
-/// edges all four.
-pub fn perm_change(builder: &JobBuilder, agent: &str, payload: PermPayload) {
-    let write = builder
-        .node(NodeKind::WritePermFile {
-            agent: agent.to_owned(),
-            payload,
-        })
-        .needs(Resource::MetaWindow);
-    let roots = rebuild_nodes(builder, agent, true, Some(write));
-    emit_rebuilt_tails(
-        builder,
-        agent,
-        &[write, roots.meta_sync, roots.agent_window, roots.reconcile],
-    );
-}
-
 /// Meta-input lock bump. The `MetaLock` executor grows one rebuild subgraph
 /// per affected agent into *this same* DAG on completion (declared onto the
 /// builder it was handed) — appended *after* the bump lands so their prebuilds
diff --git a/hive-c0re/src/job_queue/tests.rs b/hive-c0re/src/job_queue/tests.rs
index 8ad97b8d..8247e104 100644
--- a/hive-c0re/src/job_queue/tests.rs
+++ b/hive-c0re/src/job_queue/tests.rs
@@ -1515,41 +1515,6 @@ fn destroy_container_must_not_suppress_crash_watch() {
     );
 }
 
-#[test]
-fn perm_change_shape_prefixes_rebuild_chain() {
-    let q = JobQueue::new(1);
-    insert(&q, |builder| {
-        templates::perm_change(
-            builder,
-            "agent-a",
-            PermPayload::Combined {
-                groups: Some(vec![]),
-                caps: None,
-            },
-        );
-    });
-    assert_eq!(
-        declared_shape(&q)
-            .iter()
-            .map(|d| d.kind)
-            .collect::<Vec<_>>(),
-        vec![
-            "write_perm_file",
-            "meta_sync",
-            "agent_window",
-            "prebuild",
-            "stop_for_update",
-            "swap",
-            "rebuild_bookkeeping",
-            "reconcile",
-            // the ok / !ok tail pair
-            "emit_rebuilt",
-            "emit_rebuilt",
-        ],
-        "the perm write prefixes an otherwise ordinary rebuild chain"
-    );
-}
-
 // ---- standalone sweeps ----
 
 #[test]
diff --git a/hive-c0re/src/lifecycle/host_config.rs b/hive-c0re/src/lifecycle/host_config.rs
index a0fdd10f..06fc6b57 100644
--- a/hive-c0re/src/lifecycle/host_config.rs
+++ b/hive-c0re/src/lifecycle/host_config.rs
@@ -1,13 +1,13 @@
 //! Per-container host-side config: the nspawn conf rewrite (bind mounts,
 //! network isolation, forwarded credentials), the systemd resource-limits
-//! drop-in, the agent's copy of its memory cap, and the `write_dropins` verb
-//! that re-applies them.
+//! drop-in, the agent's copies of its memory cap and stored permissions, and
+//! the `write_dropins` verb that re-applies them.
 
 use std::path::{Path, PathBuf};
 
 use anyhow::{Context, Result};
 use hive_priv_sock::{BindMount, CredentialMount};
-use hive_sh4re::permissions::Capability;
+use hive_sh4re::permissions::Permission;
 
 use crate::coordinator::{AgentPaths, HiveEnv};
 
@@ -17,14 +17,16 @@ use super::{
 };
 
 /// Re-apply the per-container host-side config: nspawn flags (bind
-/// mounts etc.), the systemd resource-limits drop-in, the agent's copy of
-/// its memory cap, and a daemon reload so all of it takes effect on the next
-/// unit (re)start. Idempotent — the job queue's `WriteDropin` node, also
-/// folded into every `Swap` (rebuild is the reconcile verb).
+/// mounts etc.), the systemd resource-limits drop-in, the agent's copies of
+/// its memory cap and stored permissions, and a daemon reload so all of it
+/// takes effect on the next unit (re)start. Idempotent — the job queue's
+/// `WriteDropin` node, also folded into every `Swap` (rebuild is the
+/// reconcile verb).
 pub async fn write_dropins(name: &str, hive: &HiveEnv, paths: &AgentPaths) -> Result<()> {
     validate(name)?;
     let container = container_name(name);
     set_nspawn_flags(&container, &paths.agent, &paths.claude, &paths.notes).await?;
+    hand_permissions(name, &paths.agent);
     if let Some((cpu_quota, memory_max)) = stage_limits(
         name,
         &crate::resource_limits::swarm_limits_path(),
@@ -381,22 +383,36 @@ fn bind_own_agent_dirs(agent_name: &str, notes_dir: &Path, binds: &mut Vec<BindM
     }
 }
 
-/// Whether `agent_name` holds `ManageRootAgent` per the capabilities file
-/// at `caps_path`. An unreadable file denies: the error is logged and the
+/// Whether `agent_name` holds `ManageRootAgent` per the swarm permissions
+/// stored at `path`. An unreadable file denies: the error is logged and the
 /// agent starts without the cross-agent mounts, so one corrupt file never
 /// blocks any agent's start, spawn or swap.
-fn holds_manage_root_agent(agent_name: &str, caps_path: &Path) -> bool {
-    crate::capabilities::has_cap(caps_path, agent_name, Capability::ManageRootAgent).unwrap_or_else(
-        |e| {
-            tracing::error!(
-                agent = %agent_name,
-                path = %caps_path.display(),
-                error = ?e,
-                "capabilities unreadable — no ManageRootAgent mounts"
-            );
-            false
-        },
-    )
+fn holds_manage_root_agent(agent_name: &str, path: &Path) -> bool {
+    crate::permissions::holds(path, agent_name, Permission::ManageRootAgent).unwrap_or_else(|e| {
+        tracing::error!(
+            agent = %agent_name,
+            path = %path.display(),
+            error = ?e,
+            "swarm permissions unreadable — no ManageRootAgent mounts"
+        );
+        false
+    })
+}
+
+/// Copy `agent`'s stored permissions into its runtime dir, which it holds
+/// until its own first read of the swarm's key succeeds. A failure is logged
+/// and the agent still starts, on the default.
+pub fn hand_permissions(agent: &str, runtime_dir: &Path) {
+    let pending = crate::workers::permissions_import::pending();
+    if let Err(e) =
+        crate::permissions::hand_at(&crate::permissions::path(), pending, agent, runtime_dir)
+    {
+        tracing::error!(
+            agent = %agent,
+            error = ?e,
+            "could not hand the agent its stored permissions; it holds the default until it reads its key"
+        );
+    }
 }
 
 /// Env var naming the host directory `swarm-bao-queue-agent.service` lands
@@ -569,25 +585,25 @@ async fn set_nspawn_flags(
         read_only: true,
     });
 
-    // `ManageRootAgent` capability: mount *every* agent in the hive as a
+    // `ManageRootAgent` permission: mount *every* agent in the hive as a
     // virtual child. Enables recovery — the holder can update another
     // agent's config even when that agent is down. Also grants RO access
     // to /applied and /meta.
     //
-    // ⚠️ "every agent" is the definition of this capability, not an
+    // ⚠️ "every agent" is the definition of this permission, not an
     // accident of how the set is computed. The grant used to hang off a
     // `can_manage_top_level_agents` role and cover `top_level_agents()`
     // — i.e. `parent.is_none()` — which was "everything outside the
     // hierarchy". With that hierarchy removed, every agent is
-    // parentless, so that set *was* every agent anyway; the capability
+    // parentless, so that set *was* every agent anyway; the permission
     // now says so out loud instead of deriving it from a field that no
     // longer discriminates.
     //
     // This is the *only* cross-agent mount left. Dropping the topology
     // parent field took with it the unconditional grant every
     // agent used to get over its own direct children — so an agent with
-    // no capability now sees its own dirs and nothing else.
-    if holds_manage_root_agent(agent_name, &crate::capabilities::capabilities_path()) {
+    // no permission now sees its own dirs and nothing else.
+    if holds_manage_root_agent(agent_name, &crate::permissions::path()) {
         // Skipping self is a no-op, not a narrowing: `agent_notes_dir` is
         // `agent_state_dir/state` and `config_bind_source` is shared, so
         // binding the holder as its own virtual child reproduced the two
@@ -818,22 +834,30 @@ mod tests {
     }
 
     #[test]
-    fn a_corrupt_capabilities_file_denies_without_failing() {
+    fn corrupt_swarm_permissions_deny_without_failing() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join("capabilities.json");
-        let truncated = "{\n  \"ruth\": [\"manage_root_ag";
+        let path = dir.path().join("swarm-agent-permissions.json");
+        let truncated = "{\n  \"ruth\": {\"permissions\": [\"manage_root_ag";
         std::fs::write(&path, truncated).expect("seed");
         assert!(!holds_manage_root_agent("ruth", &path));
         assert_eq!(std::fs::read(&path).expect("read"), truncated.as_bytes());
     }
 
+    /// Unset is the default, which gives ruth the recovery mounts and nobody
+    /// else; a grant or an explicit empty list replaces it.
     #[test]
-    fn a_readable_grant_is_honoured() {
+    fn the_swarm_grant_or_the_default_decides_the_recovery_mounts() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join("capabilities.json");
-        std::fs::write(&path, r#"{"ruth": ["manage_root_agent"]}"#).expect("seed");
+        let path = dir.path().join("swarm-agent-permissions.json");
         assert!(holds_manage_root_agent("ruth", &path));
         assert!(!holds_manage_root_agent("alice", &path));
+        std::fs::write(
+            &path,
+            r#"{"ruth": {"permissions": []}, "alice": {"permissions": ["manage_root_agent"]}}"#,
+        )
+        .expect("seed");
+        assert!(!holds_manage_root_agent("ruth", &path));
+        assert!(holds_manage_root_agent("alice", &path));
     }
 
     const TRUNCATED_LIMITS: &str = "{\n  \"sock\": { \"cpu_quota\": \"50%\", \"mem";
diff --git a/hive-c0re/src/lifecycle/mod.rs b/hive-c0re/src/lifecycle/mod.rs
index a513f731..580e509b 100644
--- a/hive-c0re/src/lifecycle/mod.rs
+++ b/hive-c0re/src/lifecycle/mod.rs
@@ -11,7 +11,7 @@ pub use git::{
     git, git_authed, git_command, git_command_authed, git_is_ancestor, git_read_tree_reset,
     git_rev_parse, git_tag, git_update_ref, git_update_ref_cas,
 };
-pub use host_config::write_dropins;
+pub use host_config::{hand_permissions, write_dropins};
 pub use setup::{
     ensure_agent_state_subvolume, ensure_claude_dir, ensure_state_dir, initial_flake_nix,
     setup_applied, setup_proposed,
diff --git a/hive-c0re/src/main.rs b/hive-c0re/src/main.rs
index c0ff3bed..761d32ea 100644
--- a/hive-c0re/src/main.rs
+++ b/hive-c0re/src/main.rs
@@ -43,7 +43,7 @@ mod swarm_status;
 mod test_env;
 mod workers;
 
-pub(crate) use agent_config::{capabilities, limits, resource_limits, tool_groups, topology};
+pub(crate) use agent_config::{limits, permissions, resource_limits, topology};
 pub(crate) use stats::{container_stats, hive_stats, host_stats, otel_metrics, warnings};
 pub(crate) use stores::{broker, build_logs, db, power};
 pub(crate) use workers::{agent_sockets, auto_update, crash_watch, knowledge, mcp_sockets};
@@ -277,6 +277,9 @@ async fn cmd_serve(
     if let Err(e) = migrate::run(&coord).await {
         tracing::warn!(error = ?e, "startup migration failed");
     }
+    // Before any agent starts, so the bind mounts it gets from the stored
+    // permissions are the meta repo's grants until the swarm answers.
+    crate::workers::permissions_import::seed_local();
     // Auto-create the root agent container if it isn't there yet. Block
     // on this — without root the system has no manager harness.
     // Failures are logged but allowed: a broken auto-spawn shouldn't
diff --git a/hive-c0re/src/meta.rs b/hive-c0re/src/meta.rs
index ce916fa8..c567f9b6 100644
--- a/hive-c0re/src/meta.rs
+++ b/hive-c0re/src/meta.rs
@@ -45,26 +45,14 @@ pub struct AgentSpec {
     pub port: u16,
 }
 
-/// Stage every generated meta JSON file that exists: topology.json is
-/// regenerated by `reconcile` whenever the agent set changed;
-/// tool-groups/capabilities are created lazily on
-/// first write (`set_groups`/`set_caps`) — absent means
-/// every agent is on defaults, no file needed. Without staging, an
+/// Stage topology.json if it exists: it is regenerated by `reconcile`
+/// whenever the agent set changed. Without staging, an
 /// existing-but-untracked file shows up as untracked in the meta repo,
 /// which can confuse nix's dirty-tree fetch. `git add` is a no-op when
 /// content is unchanged.
 async fn stage_generated_meta_files(dir: &std::path::Path) -> Result<()> {
-    for (path, name) in [
-        (crate::topology::topology_path(), "topology.json"),
-        (crate::tool_groups::tool_groups_path(), "tool-groups.json"),
-        (
-            crate::capabilities::capabilities_path(),
-            "capabilities.json",
-        ),
-    ] {
-        if path.exists() {
-            git(dir, &["add", name]).await?;
-        }
+    if crate::topology::topology_path().exists() {
+        git(dir, &["add", "topology.json"]).await?;
     }
     Ok(())
 }
@@ -84,7 +72,7 @@ pub async fn sync_agents(hive: &HiveEnv, agents: &[AgentSpec]) -> Result<()> {
     let dir = crate::paths::meta_root();
     std::fs::create_dir_all(&dir).with_context(|| format!("create {}", dir.display()))?;
 
-    let new_flake = render_hive_flake(hive, agents)?;
+    let new_flake = render_hive_flake(hive, agents);
     let flake_path = dir.join("flake.nix");
     let on_disk = std::fs::read_to_string(&flake_path).unwrap_or_default();
     let initial = !dir.join(".git").exists();
@@ -197,8 +185,6 @@ pub async fn sync_agents(hive: &HiveEnv, agents: &[AgentSpec]) -> Result<()> {
                 // Only ever a REMOVAL now; see `is_embedded_ca_name`.
                 f if f.starts_with("peer-ca-") && has_pem_ext(f) => Some("peer-ca"),
                 "topology.json" => Some("topology"),
-                "capabilities.json" => Some("capabilities"),
-                "tool-groups.json" => Some("tool-groups"),
                 _ => None,
             })
             .collect();
@@ -304,90 +290,35 @@ pub async fn lock_update_hyperhive() -> Result<()> {
     git_commit_paths(&dir, "bump hyperhive", &["flake.lock"]).await
 }
 
-/// Write the tool-groups file for `agent` and commit it atomically
-/// under `META_LOCK`. Ensures the JSON change is staged + committed
-/// before the next `sync_agents` runs, so the
-/// working tree is never left dirty by an untimely `PermChange` write.
-pub async fn commit_tool_groups(agent: &str, groups: &[String]) -> Result<()> {
-    let _guard = META_LOCK.lock().await;
-    crate::tool_groups::set_groups(agent, groups)?;
-    let dir = crate::paths::meta_root();
-    if crate::tool_groups::tool_groups_path().exists() {
-        git(&dir, &["add", "tool-groups.json"]).await?;
-    }
-    if paths_dirty(&dir, &["tool-groups.json"]).await? {
-        git_commit_paths(
-            &dir,
-            &format!("set tool-groups for {agent}"),
-            &["tool-groups.json"],
-        )
-        .await?;
-    }
-    Ok(())
-}
-
-/// Write the capabilities file for `agent` and commit it atomically
-/// under `META_LOCK`. Same rationale as `commit_tool_groups`.
-pub async fn commit_capabilities(agent: &str, caps: &[String]) -> Result<()> {
-    let _guard = META_LOCK.lock().await;
-    crate::capabilities::set_caps(agent, caps)
-        .map_err(|e| anyhow::anyhow!("set capabilities for {agent}: {e}"))?;
-    let dir = crate::paths::meta_root();
-    if crate::capabilities::capabilities_path().exists() {
-        git(&dir, &["add", "capabilities.json"]).await?;
-    }
-    if paths_dirty(&dir, &["capabilities.json"]).await? {
-        git_commit_paths(
-            &dir,
-            &format!("set capabilities for {agent}"),
-            &["capabilities.json"],
-        )
-        .await?;
-    }
-    Ok(())
-}
-
-/// Write both perm files for `agent` (whichever are `Some`) and commit
-/// them in a SINGLE git commit under `META_LOCK` — the batch
-/// `POST /api/permissions` path. A `None` field leaves that file
-/// untouched. One commit + (caller does) one rebuild means changing an
-/// agent's caps and tool-groups together no longer triggers two
-/// rebuilds. Mirrors the staging discipline of `commit_tool_groups` /
-/// `commit_capabilities`.
+/// Delete the meta repo's permission files and commit the removal under
+/// `META_LOCK`. Their grants live in the swarm's `agent-permissions` bucket
+/// once `workers::permissions_import` has sent them.
 ///
 /// # Errors
 ///
-/// Returns an error if writing either JSON file fails, a capability name
-/// is invalid (`set_caps`), or a git stage/commit step fails.
-pub async fn commit_perms(
-    agent: &str,
-    groups: Option<&[String]>,
-    caps: Option<&[String]>,
-) -> Result<()> {
+/// Removing a file or a git stage/commit step fails.
+pub async fn remove_permission_files() -> Result<()> {
     let _guard = META_LOCK.lock().await;
     let dir = crate::paths::meta_root();
-    let mut parts: Vec<&str> = Vec::new();
-    if let Some(groups) = groups {
-        crate::tool_groups::set_groups(agent, groups)?;
-        if crate::tool_groups::tool_groups_path().exists() {
-            git(&dir, &["add", "tool-groups.json"]).await?;
+    let mut removed = Vec::new();
+    for file in crate::workers::permissions_import::META_FILES {
+        match std::fs::remove_file(dir.join(file)) {
+            Ok(()) => {}
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => return Err(e).with_context(|| format!("removing {file}")),
         }
-        parts.push("tool-groups");
-    }
-    if let Some(caps) = caps {
-        crate::capabilities::set_caps(agent, caps)
-            .map_err(|e| anyhow::anyhow!("set capabilities for {agent}: {e}"))?;
-        if crate::capabilities::capabilities_path().exists() {
-            git(&dir, &["add", "capabilities.json"]).await?;
+        git(&dir, &["rm", "--cached", "--ignore-unmatch", "-q", file]).await?;
+        // Only a tracked file has a removal to commit; naming an untracked
+        // one makes `git commit -- <path>` fail.
+        if paths_dirty(&dir, &[file]).await? {
+            removed.push(*file);
         }
-        parts.push("capabilities");
     }
-    let paths = ["tool-groups.json", "capabilities.json"];
-    if paths_dirty(&dir, &paths).await? {
+    if !removed.is_empty() {
         git_commit_paths(
             &dir,
-            &format!("set {} for {agent}", parts.join(" + ")),
-            &paths,
+            "permissions moved to the swarm's agent-permissions",
+            &removed,
         )
         .await?;
     }
@@ -396,7 +327,7 @@ pub async fn commit_perms(
 
 /// [`render_flake`] with its inputs taken from `hive`, as [`sync_agents`]
 /// renders it.
-fn render_hive_flake(hive: &HiveEnv, agents: &[AgentSpec]) -> Result<String> {
+fn render_hive_flake(hive: &HiveEnv, agents: &[AgentSpec]) -> String {
     render_flake(
         &hive.hyperhive_flake,
         &hive.hyperhive_docs_flake,
@@ -423,7 +354,7 @@ fn render_flake(
     operator_pronouns: &str,
     context_window_tokens: &std::collections::HashMap<String, u64>,
     agents: &[AgentSpec],
-) -> Result<String> {
+) -> String {
     render_flake_with_lookup(
         hyperhive_flake,
         docs_flake,
@@ -826,7 +757,7 @@ fn render_flake_with_lookup<F>(
     context_window_tokens: &std::collections::HashMap<String, u64>,
     agents: &[AgentSpec],
     lookup: F,
-) -> Result<String>
+) -> String
 where
     F: Fn(&str) -> Vec<&'static str>,
 {
@@ -905,7 +836,7 @@ where
     let pronouns_escaped = operator_pronouns.replace('\\', "\\\\").replace('"', "\\\"");
     let _ = writeln!(
         out,
-        "      dashboardPort = {dashboard_port};\n      operatorPronouns = \"{pronouns_escaped}\";\n      mkAgent = {{ name, isManager, port, toolGroups ? null, capabilities ? null }}:"
+        "      dashboardPort = {dashboard_port};\n      operatorPronouns = \"{pronouns_escaped}\";\n      mkAgent = {{ name, isManager, port }}:"
     );
     out.push_str(
         r#"        let
@@ -914,8 +845,6 @@ where
                  else hyperhive.nixosConfigurations.agent-base;
           input = inputs."agent-${name}";
           service = "hive-agent";
-          toolGroupsEnv = if toolGroups == null then {} else { HIVE_TOOL_GROUPS = toolGroups; };
-          capabilitiesEnv = if capabilities == null then {} else { HIVE_CAPABILITIES = capabilities; };
         in
         base.extendModules {
           modules = [
@@ -1092,7 +1021,7 @@ where
     }
     out.push_str(
         r"              };
-              systemd.services.${service}.environment = toolGroupsEnv // capabilitiesEnv // {
+              systemd.services.${service}.environment = {
                 HIVE_PORT = toString port;
                 HIVE_LABEL = name;
                 HIVE_DASHBOARD_PORT = toString dashboardPort;
@@ -1136,49 +1065,18 @@ where
       nixosConfigurations = {
 "#,
     );
-    // Propagated, never read as empty: an agent with no tool-groups entry
-    // renders `toolGroups = null` and gets `AGENT_DEFAULT`, which fails
-    // open for any agent whose explicit entry is narrower.
-    let tool_groups_map = crate::tool_groups::read()?;
-    let capabilities_map = crate::capabilities::read()?;
     for spec in agents {
-        // Emit `toolGroups = "group1,group2"` when the operator has
-        // explicitly configured groups for this agent. Absent entry = null
-        // = harness falls back to AGENT_DEFAULT (no env var emitted,
-        // no rebuild cascade for agents whose groups haven't changed).
-        let groups = tool_groups_map.get(&spec.name).cloned().unwrap_or_default();
-        let tool_groups_attr = if groups.is_empty() {
-            "null".to_owned()
-        } else {
-            let joined = groups.join(",");
-            format!("\"{joined}\"")
-        };
-        // Emit `capabilities = "cap1,cap2"` when the operator has
-        // granted capabilities to this agent. Absent entry = null = no
-        // capability env var injected, capability-gated tools hidden.
-        let caps = capabilities_map
-            .get(&spec.name)
-            .cloned()
-            .unwrap_or_default();
-        let capabilities_attr = if caps.is_empty() {
-            "null".to_owned()
-        } else {
-            let joined = caps.join(",");
-            format!("\"{joined}\"")
-        };
         let _ = writeln!(
             out,
-            "        {} = mkAgent {{ name = \"{}\"; isManager = {}; port = {}; toolGroups = {}; capabilities = {}; }};",
+            "        {} = mkAgent {{ name = \"{}\"; isManager = {}; port = {}; }};",
             spec.name,
             spec.name,
             if spec.is_manager { "true" } else { "false" },
             spec.port,
-            tool_groups_attr,
-            capabilities_attr,
         );
     }
     out.push_str("      };\n    };\n}\n");
-    Ok(out)
+    out
 }
 
 /// Return the list of file names that are currently staged (index differs
@@ -1263,7 +1161,7 @@ async fn git_commit(dir: &Path, message: &str) -> Result<()> {
 
 /// Path-limited commit: commits ONLY the given paths, so unrelated
 /// staged content can never be swept into someone else's commit. Every targeted
-/// meta commit (perm files, topology, lock bumps) goes through this;
+/// meta commit (limits, topology, lock bumps) goes through this;
 /// only `sync_agents` uses the bare [`git_commit`], because its
 /// staged set *is* its intentional commit set.
 async fn git_commit_paths(dir: &Path, message: &str, paths: &[&str]) -> Result<()> {
@@ -1354,29 +1252,35 @@ mod tests {
         git(dir, &["init", "--initial-branch=main"])
             .await
             .expect("git init");
-        std::fs::write(dir.join("tool-groups.json"), "{}").expect("write");
+        std::fs::write(dir.join("resource-limits.json"), "{}").expect("write");
         std::fs::write(dir.join("flake.lock"), "v1").expect("write");
         git(dir, &["add", "-A"]).await.expect("add");
         git_commit(dir, "seed").await.expect("seed commit");
         // Something stages a new lock (uncommitted)…
         std::fs::write(dir.join("flake.lock"), "v2-staged-by-deploy").expect("write");
         git(dir, &["add", "flake.lock"]).await.expect("stage lock");
-        // …and a perm change commits, path-limited.
-        std::fs::write(dir.join("tool-groups.json"), r#"{"alice":[]}"#).expect("write");
-        git(dir, &["add", "tool-groups.json"]).await.expect("add");
-        git_commit_paths(dir, "set tool-groups for alice", &["tool-groups.json"])
+        // …and a limits change commits, path-limited.
+        std::fs::write(dir.join("resource-limits.json"), r#"{"alice":[]}"#).expect("write");
+        git(dir, &["add", "resource-limits.json"])
             .await
-            .expect("path-limited commit");
-        // The perm file is committed; the staged lock is not.
+            .expect("add");
+        git_commit_paths(
+            dir,
+            "set resource limits for alice",
+            &["resource-limits.json"],
+        )
+        .await
+        .expect("path-limited commit");
+        // The limits file is committed; the staged lock is not.
         assert!(
-            !paths_dirty(dir, &["tool-groups.json"])
+            !paths_dirty(dir, &["resource-limits.json"])
                 .await
                 .expect("check"),
-            "perm file must be committed"
+            "limits file must be committed"
         );
         assert!(
             paths_dirty(dir, &["flake.lock"]).await.expect("check"),
-            "staged deploy lock must survive the perm commit"
+            "staged deploy lock must survive the limits commit"
         );
     }
 
@@ -1413,8 +1317,7 @@ mod tests {
             "she/her",
             &std::collections::HashMap::new(),
             &[sample_spec("alice", false, 9001)],
-        )
-        .expect("render flake");
+        );
         // nixpkgs is a top-level input with an explicit URL; hyperhive
         // follows it.
         assert!(
@@ -1460,8 +1363,7 @@ mod tests {
             "she/her",
             &std::collections::HashMap::new(),
             &[sample_spec("alice", false, 9001)],
-        )
-        .expect("render flake");
+        );
         assert!(
             !out.contains("hyperhive-docs"),
             "no docs input/source when docs_flake is empty:\n{out}"
@@ -1479,8 +1381,7 @@ mod tests {
             "she/her",
             &std::collections::HashMap::new(),
             &[sample_spec("alice", false, 9001)],
-        )
-        .expect("render flake");
+        );
         assert!(
             out.contains(r#"networking.hostName = "h-${name}";"#),
             "an agent container with no hostname of its own is called `nixos`, \
@@ -1520,8 +1421,7 @@ mod tests {
             "she/her",
             &std::collections::HashMap::new(),
             &[sample_spec("alice", false, 9001)],
-        )
-        .expect("render flake");
+        );
         assert!(
             out.contains(
                 "services.hyperhive.agent.claudeCodePath = \"/nix/store/cccc-claude-code-2.1.220\";"
@@ -1549,8 +1449,7 @@ mod tests {
             "she/her",
             &std::collections::HashMap::new(),
             &[sample_spec("alice", false, 9001)],
-        )
-        .expect("render flake");
+        );
         assert!(
             !out.contains("claudeCodePath"),
             "no claude assignment when unpinned:\n{out}"
@@ -1570,8 +1469,7 @@ mod tests {
             "she/her",
             &std::collections::HashMap::new(),
             &[sample_spec("alice", false, 9001)],
-        )
-        .expect("render flake");
+        );
         assert!(
             out.contains("nixpkgs.follows = \"hyperhive/nixpkgs\""),
             "expected fallback follows:\n{out}"
@@ -1606,8 +1504,7 @@ mod tests {
                 sample_spec("dmatrix", false, 9003),
             ],
             lookup,
-        )
-        .expect("render flake");
+        );
         // bitburner declares nixpkgs → follows emitted.
         assert!(
             out.contains("agent-bitburner.inputs.nixpkgs.follows = \"nixpkgs\""),
@@ -1636,8 +1533,7 @@ mod tests {
             &std::collections::HashMap::new(),
             &[sample_spec("alice", false, 9001)],
             |_| Vec::new(),
-        )
-        .expect("render flake");
+        );
         // No agent-side follows when the lookup reports nothing
         // declared — protects agents whose flake.lock can't be read
         // (missing / unparsable) from being broken by a follows on a
@@ -1674,8 +1570,7 @@ mod tests {
             "she/her",
             &std::collections::HashMap::new(),
             &[sample_spec("alice", false, 9001)],
-        )
-        .expect("render flake");
+        );
         unsafe {
             std::env::remove_var("HIVE_FORGE_URL");
         }
@@ -1721,7 +1616,6 @@ mod tests {
                 &std::collections::HashMap::new(),
                 &[sample_spec("alice", false, 9001)],
             )
-            .expect("render flake")
         };
         let alpha = render_on("alpha-hive", "alpha-hive.example.test");
         let beta = render_on("beta-hive", "beta-hive.example.test");
@@ -1901,8 +1795,7 @@ mod tests {
             "she/her",
             &std::collections::HashMap::new(),
             &[sample_spec("alice", false, 9001)],
-        )
-        .expect("render flake");
+        );
         unsafe {
             std::env::remove_var("HIVE_FORGE_URL");
             std::env::remove_var("HIVE_MATRIX_URL");
@@ -1938,8 +1831,7 @@ mod tests {
             "she/her",
             &std::collections::HashMap::new(),
             &[sample_spec("alice", false, 9001)],
-        )
-        .expect("render flake");
+        );
         let want = format!(
             "agent-alice.url = \"git+file://{}\"",
             crate::paths::applied_dir("alice").display()
@@ -1984,7 +1876,6 @@ mod tests {
                 &std::collections::HashMap::new(),
                 &[sample_spec("alice", false, 9001)],
             )
-            .expect("render flake")
         };
 
         // A leftover peer-CA file + the env var that names it. Both must be
@@ -2077,7 +1968,6 @@ mod tests {
                 &std::collections::HashMap::new(),
                 &[sample_spec("alice", false, 9001)],
             )
-            .expect("render flake")
         };
         unsafe {
             std::env::remove_var("HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES");
@@ -2152,7 +2042,6 @@ mod tests {
                 &std::collections::HashMap::new(),
                 &[sample_spec("alice", false, 9001)],
             )
-            .expect("render flake")
         };
         unsafe {
             std::env::remove_var("HYPERHIVE_GITHUB_DISABLED");
@@ -2184,8 +2073,8 @@ mod tests {
             ..HiveEnv::default()
         };
         let agents = [sample_spec("alice", false, 9001)];
-        let small = render_hive_flake(&hive("4G"), &agents).expect("render 4G");
-        let large = render_hive_flake(&hive("16G"), &agents).expect("render 16G");
+        let small = render_hive_flake(&hive("4G"), &agents);
+        let large = render_hive_flake(&hive("16G"), &agents);
         assert_eq!(
             small, large,
             "the rendered flake must not depend on the memory cap"
diff --git a/hive-c0re/src/migrate.rs b/hive-c0re/src/migrate.rs
index b47171b4..a6f926fd 100644
--- a/hive-c0re/src/migrate.rs
+++ b/hive-c0re/src/migrate.rs
@@ -10,10 +10,11 @@
 //!   `h-root`); both targeted layouts no live hive still has. Add one
 //!   only if it cannot be expressed as convergence, and expect to delete
 //!   it once every hive has passed it.
-//! - **Create-time setup.** Ruth's tool groups were backfilled here on
-//!   every boot; they are now seeded where she is created
-//!   (`workers::auto_update::ensure_root_agent`). A thing that is true
-//!   from birth does not need re-asserting each morning.
+//! - **Create-time setup.** A thing that is true from birth is set where
+//!   the agent is created, not re-asserted each morning. Ruth's
+//!   permissions need neither: with no key in the swarm's
+//!   `agent-permissions` bucket she holds the code-constant default
+//!   (`Permission::default_for`).
 //!
 //! Kill-switch: `HIVE_SKIP_META_MIGRATION=1`. Full sequence and phase
 //! details: `docs/agent-lifecycle/config-changes.md::Startup migrations (older hosts)`.
diff --git a/hive-c0re/src/socket_server/mod.rs b/hive-c0re/src/socket_server/mod.rs
index 525a961f..b90145ed 100644
--- a/hive-c0re/src/socket_server/mod.rs
+++ b/hive-c0re/src/socket_server/mod.rs
@@ -79,8 +79,8 @@ pub fn start(agent: &str, socket_path: &Path, coord: Arc<Coordinator>) -> Result
 
 /// Bind + serve the manager socket. This is now **pure transport**: it grants
 /// no authority of its own — it just serves requests as `agent = MANAGER_AGENT`
-/// ("ruth"), and ruth's reach comes entirely from the capabilities /
-/// tool-groups it holds, identical to connecting on a per-agent socket — ruth
+/// ("ruth"), and ruth's reach comes entirely from the permissions it
+/// holds, identical to connecting on a per-agent socket — ruth
 /// uses the standard per-agent runtime dir + socket, with no dedicated helpers.
 pub fn start_manager(coord: Arc<Coordinator>) -> Result<()> {
     use std::os::unix::fs::PermissionsExt as _;
diff --git a/hive-c0re/src/swarm_status.rs b/hive-c0re/src/swarm_status.rs
index c4cfc54b..659d1f11 100644
--- a/hive-c0re/src/swarm_status.rs
+++ b/hive-c0re/src/swarm_status.rs
@@ -98,7 +98,7 @@ pub fn spawn(
         // reason, and is a third consumer rather than a second connection.
         tokio::spawn(crate::workers::wanted::watch_declarations(
             client.clone(),
-            coord,
+            std::sync::Arc::clone(&coord),
             hive.clone(),
             shutdown.clone(),
         ));
@@ -109,6 +109,14 @@ pub fn spawn(
             shutdown.clone(),
         ));
 
+        // The permissions the swarm grants, and the import of the meta repo's.
+        tokio::spawn(crate::workers::swarm_permissions::follow(
+            client.clone(),
+            std::sync::Arc::clone(&coord),
+            hive.clone(),
+            shutdown.clone(),
+        ));
+
         let mut health = SweepHealth::new("swarm_status_publish", "warn", FAILURES_BEFORE_BANNER);
         loop {
             match publish(&client, &hive).await {
diff --git a/hive-c0re/src/workers/auto_update.rs b/hive-c0re/src/workers/auto_update.rs
index ac31b48f..d4661870 100644
--- a/hive-c0re/src/workers/auto_update.rs
+++ b/hive-c0re/src/workers/auto_update.rs
@@ -23,7 +23,6 @@ use anyhow::Result;
 
 use crate::coordinator::Coordinator;
 use crate::lifecycle::{self, AGENT_PREFIX, MANAGER_NAME};
-use crate::tool_groups;
 
 /// Resolve the current rev of `hyperhive_flake`. For a path on disk we
 /// canonicalize (following symlinks) so a /etc/hyperhive → /nix/store/...
@@ -124,10 +123,6 @@ pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
         );
         return Ok(());
     }
-    // Before the create/start branch, not inside it: on a hive whose root
-    // container already exists this is the only run that can still seed the
-    // grant, and it has to land before her next rebuild bakes the binds.
-    seed_manager_capabilities();
     let list_result = lifecycle::list().await;
     if let Err(e) = &list_result {
         tracing::warn!(
@@ -204,7 +199,6 @@ pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
     let hive = coord.hive_env();
     let paths = Coordinator::agent_paths(MANAGER_NAME, runtime)?;
     lifecycle::spawn(MANAGER_NAME, &hive, &paths).await?;
-    seed_manager_tool_groups();
     if let Err(e) = coord.power.set(MANAGER_NAME, crate::power::Wanted::Up) {
         tracing::warn!(error = ?e, "agent_power: set manager wanted=up failed");
     }
@@ -216,109 +210,6 @@ pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
     Ok(())
 }
 
-/// Give ruth her privileged tool groups on the one path that creates her.
-///
-/// `effective_tool_groups()` has no manager-flavour fallback, so an agent
-/// with no entry in `tool-groups.json` is an agent with no privileged
-/// tools. Ruth needs hers from her first turn, and this is the only place
-/// she is brought into existence — so it is written once, here, rather
-/// than re-checked on every hive-c0re boot.
-///
-/// Skips a name that already has an entry: a destroy+recreate under the
-/// same name must not silently reset an operator's chosen group set back
-/// to the default. An unreadable file is logged and left alone: ruth has
-/// already been spawned, and seeding stays best-effort like the write
-/// below.
-fn seed_manager_tool_groups() {
-    match tool_groups::groups_for(MANAGER_NAME) {
-        Ok(groups) if groups.is_empty() => {}
-        Ok(_) => {
-            tracing::debug!("manager tool groups already set — leaving as-is");
-            return;
-        }
-        Err(e) => {
-            tracing::warn!(
-                error = ?e,
-                "tool-groups file unreadable — not seeding ruth's tool groups"
-            );
-            return;
-        }
-    }
-    let all_groups: Vec<String> = hive_sh4re::permissions::ToolGroup::MANAGER_DEFAULT
-        .iter()
-        .map(|g| <&str>::from(*g).to_owned())
-        .collect();
-    match tool_groups::set_groups(MANAGER_NAME, &all_groups) {
-        Ok(()) => tracing::info!("seeded ruth's tool groups to MANAGER_DEFAULT (all groups)"),
-        Err(e) => tracing::warn!(
-            error = ?e,
-            "failed to seed ruth's tool groups — she will start without privileged tools"
-        ),
-    }
-}
-
-/// The capability the root agent is seeded with, as the `snake_case` string
-/// `capabilities.json` stores and `capabilities::has_cap` compares against.
-/// Taken from the enum rather than written out, so the seed cannot drift into
-/// a name `capabilities::prune_unknown` would silently drop.
-fn manager_seed_caps() -> Vec<String> {
-    vec![<&str>::from(hive_sh4re::permissions::Capability::ManageRootAgent).to_owned()]
-}
-
-/// Whether the root agent's default capability grant should be written.
-///
-/// `store_written` is "`capabilities.json` exists" — see
-/// [`seed_manager_capabilities`] for why that, and not the absence of an
-/// entry for the manager, is the condition.
-fn should_seed_manager_caps(store_written: bool) -> bool {
-    !store_written
-}
-
-/// Give ruth the `ManageRootAgent` capability on the path that deploys her.
-///
-/// This is the capability-store half of the grant `roles.json` used to make:
-/// `topology::reconcile_roles` seeded `can_manage_top_level_agents` onto
-/// `MANAGER_NAME` on every meta sync, and that role is what put the other
-/// agents' state/config dirs, `/applied` and `/meta` into her nspawn binds.
-/// Collapsing the role into the capability means that without a seed here she
-/// loses those recovery mounts at her next container rebuild — silently, and
-/// only then, because nspawn bakes bind flags at container start.
-///
-/// **Seeded once, not re-ensured on every boot.** The role kept an empty-list
-/// tombstone so an explicit revoke stuck; the capability store *deletes* an
-/// entry that has been emptied rather than tombstoning it, so "the manager
-/// has no entry" cannot tell a fresh hive apart from a deliberate revoke.
-/// File existence can: every grant and revoke goes through
-/// `meta::commit_capabilities` → `capabilities::set_caps`, which
-/// writes the file even when the result is an empty `{}`. So while the file
-/// is absent nobody has ever had a say, and once it exists this is inert
-/// forever — including on the destroy+recreate path, matching
-/// [`seed_manager_tool_groups`]'s refusal to reset an operator's choice.
-///
-/// Written with plain `set_caps` rather than `meta::commit_capabilities`: the
-/// role's own seed wrote the file and left it for `stage_generated_meta_files`
-/// to `git add` into the next deploy commit, and taking `META_LOCK` on the
-/// boot path would be a new ordering constraint for no gain.
-fn seed_manager_capabilities() {
-    if !should_seed_manager_caps(crate::capabilities::capabilities_path().exists()) {
-        tracing::debug!(
-            "capabilities.json already written — leaving the manager's capabilities as-is"
-        );
-        return;
-    }
-    let caps = manager_seed_caps();
-    match crate::capabilities::set_caps(MANAGER_NAME, &caps) {
-        Ok(()) => tracing::info!(
-            caps = ?caps,
-            "seeded ruth's default capabilities (recovery bind mounts for every agent)"
-        ),
-        Err(e) => tracing::warn!(
-            error = ?e,
-            "failed to seed ruth's capabilities — she will come up without the recovery mounts"
-        ),
-    }
-}
-
 /// Boot reconcile (see the module doc): classify every agent by rev
 /// freshness + persisted `wanted` intent, submit one `Boot` DAG
 /// (hyperhive lock bump growing an in-DAG rebuild subgraph per stale
@@ -572,10 +463,7 @@ fn submit_boot_tree(
 
 #[cfg(test)]
 mod tests {
-    use super::{
-        BootAction, MANAGER_NAME, RootAgentPlan, boot_action, manager_seed_caps, plan_root_agent,
-        should_seed_manager_caps,
-    };
+    use super::{BootAction, MANAGER_NAME, RootAgentPlan, boot_action, plan_root_agent};
     use crate::lifecycle::AGENT_PREFIX;
     use crate::power::Wanted;
 
@@ -604,45 +492,6 @@ mod tests {
         assert_eq!(plan_root_agent(result), RootAgentPlan::Present);
     }
 
-    // -----------------------------------------------------------------------
-    // Root-agent capability seed. `capabilities_path()` resolves under
-    // `paths::meta_root()`, which is hardcoded to `/var/lib/hyperhive` with no
-    // test override, so — same as `capabilities.rs`'s own tests — these pin
-    // the pure decision (`should_seed_manager_caps`, `manager_seed_caps`)
-    // rather than round-tripping the real file. Together they are the
-    // replacement for the deleted `reconcile_roles_in_seeds_root_when_absent`
-    // and `reconcile_roles_in_does_not_reseed_after_explicit_revoke`.
-
-    #[test]
-    fn the_manager_is_seeded_while_the_capability_store_has_never_been_written() {
-        assert!(should_seed_manager_caps(false));
-        assert_eq!(manager_seed_caps(), vec!["manage_root_agent".to_owned()]);
-    }
-
-    /// The revoke-sticks half, and the reason the condition is the file rather
-    /// than the manager's entry: the store deletes an emptied entry instead of
-    /// keeping a tombstone, but a revoke still writes the file — so once it
-    /// exists the seed must never fire again.
-    #[test]
-    fn a_written_capability_store_is_never_reseeded() {
-        assert!(!should_seed_manager_caps(true));
-    }
-
-    /// A seed the store would drop as unrecognised grants nothing while
-    /// logging success, so pin that what we write is a name `prune_unknown`
-    /// keeps — i.e. one of `Capability::ALL`'s `snake_case` spellings.
-    #[test]
-    fn the_seeded_name_is_a_capability_the_store_recognises() {
-        for cap in manager_seed_caps() {
-            assert!(
-                hive_sh4re::permissions::Capability::ALL
-                    .iter()
-                    .any(|known| <&str>::from(*known) == cap),
-                "{cap} is not a known capability"
-            );
-        }
-    }
-
     // The regression the `Unreadable` variant exists for: the arm used to
     // substitute `from_running(running)`, which is `Noop` against BOTH
     // observations — so no combination of inputs could reach a reconcile.
diff --git a/hive-c0re/src/workers/mod.rs b/hive-c0re/src/workers/mod.rs
index 6f2ffa4c..118f923b 100644
--- a/hive-c0re/src/workers/mod.rs
+++ b/hive-c0re/src/workers/mod.rs
@@ -1,7 +1,7 @@
 //! Background tasks and periodic sweeps: crash/login watcher, boot-time
 //! auto-update reconcile, the agent-sockets.json writer loop, the MCP socket listener
 //! reconcile loop, knowledge-repo sync, the swarm wanted-state pull, and the
-//! swarm resource-cap read.
+//! swarm resource-cap and permissions reads.
 //! Each submodule is re-exported
 //! at the crate root, so `crate::crash_watch::…` etc. keep working unchanged.
 
@@ -10,5 +10,7 @@ pub mod auto_update;
 pub mod crash_watch;
 pub mod knowledge;
 pub mod mcp_sockets;
+pub mod permissions_import;
 pub mod swarm_limits;
+pub mod swarm_permissions;
 pub mod wanted;
diff --git a/hive-c0re/src/workers/permissions_import.rs b/hive-c0re/src/workers/permissions_import.rs
new file mode 100644
index 00000000..97db2a07
--- /dev/null
+++ b/hive-c0re/src/workers/permissions_import.rs
@@ -0,0 +1,338 @@
+//! The one-shot move of the permissions this hive's meta repo held
+//! (`meta/capabilities.json` and `meta/tool-groups.json`) into the swarm's
+//! `agent-permissions` bucket, as one list per agent.
+//!
+//! At boot, before any agent starts, [`seed_local`] copies the files' grants
+//! into [`crate::permissions`] when nothing is stored there yet, so agents
+//! keep their mounts until the swarm answers. [`send_pending`] then sends the
+//! grants to swarm-controller, which writes each agent's key only where there
+//! is none, and on its answer deletes both files from the meta repo. Nothing
+//! reads them after that.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context, Result};
+use hive_sh4re::permissions::Permission;
+use swarm_queue_client::agent_permissions::{
+    self, AgentPermissions, IMPORT_REPLY_DEADLINE, Import, ImportReply,
+};
+
+const CAPABILITIES_FILE: &str = "capabilities.json";
+const TOOL_GROUPS_FILE: &str = "tool-groups.json";
+
+/// The meta repo files the grants are moved out of.
+pub const META_FILES: &[&str] = &[CAPABILITIES_FILE, TOOL_GROUPS_FILE];
+
+/// Tool groups the files may name that give nothing and have no
+/// [`Permission`]: dropped.
+const EMPTY_TOOL_GROUPS: &[&str] = &["lifecycle", "forge"];
+
+type Grants = BTreeMap<String, Vec<Permission>>;
+type FileMap = BTreeMap<String, Vec<String>>;
+
+fn parse(agent: &str, name: &str) -> Option<Permission> {
+    let found = Permission::ALL
+        .iter()
+        .copied()
+        .find(|p| name.eq_ignore_ascii_case(<&str>::from(*p)));
+    if found.is_none()
+        && !EMPTY_TOOL_GROUPS
+            .iter()
+            .any(|g| name.eq_ignore_ascii_case(g))
+    {
+        tracing::warn!(%agent, permission = %name, "import: dropping unrecognised name");
+    }
+    found
+}
+
+/// The one list per agent the two files add up to, as the swarm stores it.
+/// `None` for either file means it does not exist.
+///
+/// Each half is what the agent held under the old readers:
+/// - tool groups: the entry's known names; an absent entry, or one naming
+///   only unknown names, was the default groups. `lifecycle`/`forge` count as
+///   known (they parsed) and are then dropped, so an entry of only those
+///   held no tools and imports as none.
+/// - capabilities: the entry's names. With the file present, `ruth` having no
+///   entry means her grant was revoked: the file was created holding it, and
+///   a revoke removed the entry. With no file, the default.
+///
+/// An agent whose list equals [`Permission::default_for`] is left out, so its
+/// key stays unset and follows the default.
+fn grants(caps: Option<&FileMap>, groups: Option<&FileMap>) -> Grants {
+    let mut agents: BTreeSet<&str> = BTreeSet::new();
+    agents.extend(caps.iter().flat_map(|m| m.keys().map(String::as_str)));
+    agents.extend(groups.iter().flat_map(|m| m.keys().map(String::as_str)));
+    if caps.is_some() {
+        agents.insert(crate::lifecycle::MANAGER_NAME);
+    }
+    let mut out = Grants::new();
+    for agent in agents {
+        let default = Permission::default_for(agent);
+        let tool_default: Vec<Permission> = default
+            .iter()
+            .copied()
+            .filter(|p| *p != Permission::ManageRootAgent)
+            .collect();
+        let tool_part = match groups.and_then(|m| m.get(agent)) {
+            Some(names)
+                if names.iter().any(|n| {
+                    parse(agent, n).is_some()
+                        || EMPTY_TOOL_GROUPS.iter().any(|g| n.eq_ignore_ascii_case(g))
+                }) =>
+            {
+                names.iter().filter_map(|n| parse(agent, n)).collect()
+            }
+            _ => tool_default,
+        };
+        let cap_part: Vec<Permission> = match caps {
+            Some(m) => m
+                .get(agent)
+                .map(|names| names.iter().filter_map(|n| parse(agent, n)).collect())
+                .unwrap_or_default(),
+            None => default
+                .iter()
+                .copied()
+                .filter(|p| *p == Permission::ManageRootAgent)
+                .collect(),
+        };
+        let mut list: Vec<Permission> = Vec::new();
+        for perm in tool_part.into_iter().chain(cap_part) {
+            if !list.contains(&perm) {
+                list.push(perm);
+            }
+        }
+        let same_as_default =
+            list.len() == default.len() && default.iter().all(|p| list.contains(p));
+        if !same_as_default {
+            out.insert(agent.to_owned(), list);
+        }
+    }
+    out
+}
+
+fn read_file(path: &Path) -> Result<Option<FileMap>> {
+    if !path.exists() {
+        return Ok(None);
+    }
+    let map = serde_json::from_slice(
+        &std::fs::read(path).with_context(|| format!("reading {}", path.display()))?,
+    )
+    .with_context(|| format!("parsing {}", path.display()))?;
+    Ok(Some(map))
+}
+
+/// The grants the files in `meta` hold, or `None` when neither exists.
+fn read_grants(meta: &Path) -> Result<Option<Grants>> {
+    let caps = read_file(&meta.join(CAPABILITIES_FILE))?;
+    let groups = read_file(&meta.join(TOOL_GROUPS_FILE))?;
+    if caps.is_none() && groups.is_none() {
+        return Ok(None);
+    }
+    Ok(Some(grants(caps.as_ref(), groups.as_ref())))
+}
+
+fn meta_dir() -> PathBuf {
+    crate::paths::meta_root()
+}
+
+/// Whether a meta repo file is still waiting to be imported.
+#[must_use]
+pub fn pending() -> bool {
+    let meta = meta_dir();
+    META_FILES.iter().any(|f| meta.join(f).exists())
+}
+
+/// Store the files' grants as the last-read swarm permissions, when a file
+/// is still there and nothing has been stored yet.
+pub fn seed_local() {
+    if let Err(e) = seed_local_at(&meta_dir(), &crate::permissions::path()) {
+        tracing::warn!(error = ?e, "import: seeding the stored permissions from the meta repo failed");
+    }
+}
+
+fn seed_local_at(meta: &Path, stored: &Path) -> Result<()> {
+    if stored.exists() {
+        return Ok(());
+    }
+    let Some(grants) = read_grants(meta)? else {
+        return Ok(());
+    };
+    let records = grants
+        .into_iter()
+        .map(|(agent, perms)| {
+            (
+                agent,
+                AgentPermissions {
+                    permissions: Some(perms),
+                },
+            )
+        })
+        .collect();
+    crate::permissions::write_at(stored, &records).context("storing the seeded permissions")?;
+    tracing::info!("import: seeded the stored permissions from the meta repo");
+    Ok(())
+}
+
+/// What one attempt to send the import came to.
+#[derive(Debug)]
+pub enum ImportOutcome {
+    /// No meta file is left: nothing to import.
+    NothingPending,
+    /// The controller took the grants and the files are deleted.
+    Imported,
+    /// The controller answered with a refusal; the files stay.
+    Refused(String),
+    /// No answer (the controller or the queue is down), or a file could not
+    /// be read or deleted; the files stay.
+    Unsettled(anyhow::Error),
+}
+
+impl ImportOutcome {
+    /// Whether the swarm's keys may be read after this outcome. While a file
+    /// is left, an unset key may only mean its grants are not imported yet,
+    /// and reading it as the default would undo them.
+    #[must_use]
+    pub fn read_allowed(&self) -> bool {
+        matches!(self, Self::NothingPending | Self::Imported)
+    }
+
+    /// Why reading is not allowed, for the caller's log and banner.
+    #[must_use]
+    pub fn into_error(self) -> Option<anyhow::Error> {
+        match self {
+            Self::NothingPending | Self::Imported => None,
+            Self::Refused(why) => Some(anyhow::anyhow!("the controller refused the import: {why}")),
+            Self::Unsettled(e) => Some(e.context("importing the meta repo's permissions")),
+        }
+    }
+}
+
+/// Send the files' grants to swarm-controller while a file is there, and
+/// delete both once the controller has answered that it handled them. The
+/// next pass sends again after anything but [`ImportOutcome::Imported`]; the
+/// controller keeps a key it already has.
+pub async fn send_pending(client: &async_nats::Client, hive: &str) -> ImportOutcome {
+    match send_at(client, hive, &meta_dir()).await {
+        Ok(outcome) => outcome,
+        Err(e) => ImportOutcome::Unsettled(e),
+    }
+}
+
+async fn send_at(client: &async_nats::Client, hive: &str, meta: &Path) -> Result<ImportOutcome> {
+    let Some(permissions) = read_grants(meta)? else {
+        return Ok(ImportOutcome::NothingPending);
+    };
+    swarm_queue_client::ensure_connected(client)?;
+    let payload = serde_json::to_vec(&Import { permissions })?;
+    let reply = tokio::time::timeout(
+        IMPORT_REPLY_DEADLINE,
+        client.request(agent_permissions::import_subject(hive), payload.into()),
+    )
+    .await
+    .context("the controller did not answer the import")?
+    .context("sending the import")?;
+    match serde_json::from_slice(&reply.payload).context("decoding the controller's answer")? {
+        ImportReply::Imported {
+            written,
+            kept,
+            skipped,
+        } => {
+            tracing::info!(
+                ?written,
+                ?kept,
+                ?skipped,
+                "import: the controller took the meta repo's permissions"
+            );
+            crate::meta::remove_permission_files()
+                .await
+                .context("deleting the imported permission files")?;
+            Ok(ImportOutcome::Imported)
+        }
+        ImportReply::Failed { error } => Ok(ImportOutcome::Refused(error)),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{FileMap, grants, seed_local_at};
+    use hive_sh4re::permissions::Permission::{self, *};
+
+    fn file(json: &str) -> FileMap {
+        serde_json::from_str(json).expect("decodes")
+    }
+
+    /// Both files add up per agent; the empty groups and unknown names drop;
+    /// an agent left on the default is not sent.
+    #[test]
+    fn the_two_files_merge_into_one_list() {
+        let caps = file(r#"{"ruth": ["manage_root_agent"], "atlas": ["manage_root_agent"]}"#);
+        let groups = file(
+            r#"{"ruth": ["messaging", "meta", "inbox", "lifecycle", "execution"],
+                "atlas": ["messaging", "web_tools", "forge"],
+                "iris": ["messaging", "fly_to_the_moon"],
+                "sock": ["lifecycle"]}"#,
+        );
+        let out = grants(Some(&caps), Some(&groups));
+        assert!(!out.contains_key("ruth"), "ruth's seed is her default");
+        assert_eq!(out["atlas"], vec![Messaging, WebTools, ManageRootAgent]);
+        assert_eq!(out["iris"], vec![Messaging]);
+        assert_eq!(out["sock"], Vec::<Permission>::new());
+    }
+
+    /// Without a capabilities entry, ruth's existing file means a revoke; with
+    /// no capabilities file at all, her default stands.
+    #[test]
+    fn a_revoked_ruth_stays_revoked() {
+        let out = grants(Some(&file("{}")), None);
+        assert_eq!(out["ruth"], vec![Messaging, Meta, Inbox, Execution]);
+
+        let out = grants(None, Some(&file(r#"{"atlas": ["messaging"]}"#)));
+        assert!(!out.contains_key("ruth"));
+        assert_eq!(out["atlas"], vec![Messaging]);
+    }
+
+    /// The seed writes once, from the files, and never over a stored read.
+    #[test]
+    fn the_seed_copies_the_files_only_when_nothing_is_stored() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let meta = dir.path();
+        let stored = dir.path().join("stored.json");
+
+        seed_local_at(meta, &stored).expect("no file is no seed");
+        assert!(!stored.exists());
+
+        std::fs::write(
+            meta.join("capabilities.json"),
+            r#"{"atlas": ["manage_root_agent"]}"#,
+        )
+        .expect("seed");
+        seed_local_at(meta, &stored).expect("seeded");
+        assert!(crate::permissions::holds(&stored, "atlas", ManageRootAgent).expect("read"));
+        assert!(!crate::permissions::holds(&stored, "ruth", ManageRootAgent).expect("read"));
+
+        std::fs::write(&stored, "{}").expect("a later read");
+        seed_local_at(meta, &stored).expect("left alone");
+        assert_eq!(std::fs::read_to_string(&stored).expect("read"), "{}");
+    }
+
+    /// The read gate, one row per outcome: only a settled import lets the
+    /// swarm's keys be read.
+    #[test]
+    fn keys_are_read_only_once_the_import_is_settled() {
+        use super::ImportOutcome;
+        for (outcome, allowed) in [
+            (ImportOutcome::NothingPending, true),
+            (ImportOutcome::Imported, true),
+            (ImportOutcome::Refused("not a hive".to_owned()), false),
+            (
+                ImportOutcome::Unsettled(anyhow::anyhow!("no responders")),
+                false,
+            ),
+        ] {
+            assert_eq!(outcome.read_allowed(), allowed, "{outcome:?}");
+            assert_eq!(outcome.into_error().is_none(), allowed);
+        }
+    }
+}
diff --git a/hive-c0re/src/workers/swarm_permissions.rs b/hive-c0re/src/workers/swarm_permissions.rs
new file mode 100644
index 00000000..cc881da9
--- /dev/null
+++ b/hive-c0re/src/workers/swarm_permissions.rs
@@ -0,0 +1,317 @@
+//! Reading the permissions the swarm grants this hive's agents.
+//!
+//! swarm-controller keeps one key per agent in the `agent-permissions` bucket
+//! ([`swarm_queue_client::agent_permissions`]). Every [`READ_INTERVAL`] this
+//! reads the key of each agent this hive has and stores what it finds with
+//! [`crate::permissions`], where the container's bind mounts are worked out.
+//! Those are fixed when the container starts, so an agent whose
+//! `manage_root_agent` changed is restarted, after its current turn. The
+//! agent applies the rest of its permissions itself; after every pass each
+//! agent's copy of its stored entry is refreshed
+//! ([`crate::permissions::hand_at`]), which it holds until it reads its key.
+//!
+//! A failed read, or a bucket that does not answer, leaves the stored
+//! permissions as they are and restarts nothing.
+
+use std::path::Path;
+use std::sync::Arc;
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use hive_sh4re::permissions::Permission;
+use swarm_queue_client::agent_permissions::{self, AgentPermissions, Read};
+
+use crate::coordinator::Coordinator;
+use crate::permissions::{self, Stored};
+use crate::stats::sweep_health::{self, SweepHealth};
+
+/// How often the permissions are read.
+pub const READ_INTERVAL: Duration = Duration::from_secs(30);
+
+/// At [`READ_INTERVAL`] this is ~90 seconds of failing reads.
+const FAILURES_BEFORE_BANNER: u32 = 3;
+
+/// Send the meta repo's grants once, then read the permissions now and every
+/// [`READ_INTERVAL`] until shutdown.
+pub async fn follow(
+    client: async_nats::Client,
+    coord: Arc<Coordinator>,
+    hive: String,
+    mut shutdown: tokio::sync::watch::Receiver<bool>,
+) {
+    let mut health = SweepHealth::new("swarm_permissions_read", "warn", FAILURES_BEFORE_BANNER);
+    loop {
+        let import = super::permissions_import::send_pending(&client, &hive).await;
+        let pass = if import.read_allowed() {
+            sync(&client).await
+        } else {
+            Err(import
+                .into_error()
+                .unwrap_or_else(|| anyhow::anyhow!("import unsettled")))
+        };
+        match pass {
+            Ok(changed) => {
+                health.record_ok();
+                restart(&coord, changed).await;
+            }
+            Err(e) => {
+                tracing::warn!(error = ?e, "swarm permissions: the pass failed");
+                let err = format!("{e:#}");
+                health.record_err(|ctx| {
+                    let age = ctx.since_last_ok.map_or_else(
+                        || "no success this session".to_owned(),
+                        |d| format!("last ok {} ago", sweep_health::fmt_age(d)),
+                    );
+                    format!(
+                        "syncing the swarm's agent permissions is failing ({} consecutive, \
+                         {age}) — agents keep the permissions last read: {err}",
+                        ctx.consecutive
+                    )
+                });
+            }
+        }
+        hand_all().await;
+        tokio::select! {
+            () = tokio::time::sleep(READ_INTERVAL) => {}
+            _ = shutdown.changed() => {
+                tracing::info!("swarm permissions: shutdown signal received");
+                return;
+            }
+        }
+    }
+}
+
+/// Read every agent's key and store the result. Returns the agents whose
+/// `manage_root_agent` changed.
+async fn sync(client: &async_nats::Client) -> Result<Vec<String>> {
+    // An unconnected client does not fail a JetStream request, it hangs on it.
+    swarm_queue_client::ensure_connected(client)?;
+    let agents: Vec<String> = crate::lifecycle::agents_for_meta_listing()
+        .await
+        .context("enumerating this hive's agents")?
+        .into_iter()
+        .map(|spec| spec.name)
+        .collect();
+    sync_with(&agents, &permissions::path(), |agent| async move {
+        agent_permissions::read(client, &agent)
+            .await
+            .map_err(|e| anyhow::anyhow!(e))
+            .with_context(|| format!("reading the swarm's permissions for {agent}"))
+    })
+    .await
+}
+
+/// [`sync`] with the read and the file given. Nothing is written unless every
+/// read succeeds.
+async fn sync_with<F, Fut>(agents: &[String], path: &Path, read: F) -> Result<Vec<String>>
+where
+    F: Fn(String) -> Fut,
+    Fut: std::future::Future<Output = Result<Read>>,
+{
+    let mut read_now = Stored::new();
+    for agent in agents {
+        match read(agent.clone()).await? {
+            Read::Current(record) => {
+                if record != AgentPermissions::default() {
+                    read_now.insert(agent.clone(), record);
+                }
+            }
+            Read::NoBucket => {
+                tracing::debug!("swarm permissions: the agent-permissions bucket does not answer");
+                return Ok(Vec::new());
+            }
+        }
+    }
+    let stored = permissions::read_at(path).context("reading the stored swarm permissions")?;
+    if read_now == stored {
+        return Ok(Vec::new());
+    }
+    permissions::write_at(path, &read_now).context("storing the swarm permissions")?;
+    tracing::info!(permissions = ?read_now, "swarm permissions: stored the swarm's permissions");
+    Ok(agents
+        .iter()
+        .filter(|a| manages(a, &stored) != manages(a, &read_now))
+        .cloned()
+        .collect())
+}
+
+/// Refresh the copy of its stored permissions each agent with a runtime dir
+/// holds, so it follows this pass's reads and the import's progress.
+async fn hand_all() {
+    let agents = match crate::lifecycle::agents_for_meta_listing().await {
+        Ok(agents) => agents,
+        Err(e) => {
+            tracing::warn!(error = ?e, "swarm permissions: enumerating agents to hand their copies failed");
+            return;
+        }
+    };
+    for spec in agents {
+        let dir = crate::paths::agent_runtime_dir(&spec.name);
+        if dir.is_dir() {
+            crate::lifecycle::hand_permissions(&spec.name, &dir);
+        }
+    }
+}
+
+/// Whether `agent` holds the one permission hive-c0re enforces under `stored`.
+fn manages(agent: &str, stored: &Stored) -> bool {
+    permissions::effective(agent, stored.get(agent)).contains(&Permission::ManageRootAgent)
+}
+
+/// Restart each running agent in `changed` once its current turn is done, so
+/// its container starts with the bind mounts its new permissions give. A
+/// stopped agent gets them at its next start.
+async fn restart(coord: &Arc<Coordinator>, changed: Vec<String>) {
+    let mut running = Vec::new();
+    for agent in changed {
+        if crate::lifecycle::is_running(&agent).await {
+            running.push(agent);
+        }
+    }
+    if running.is_empty() {
+        return;
+    }
+    tracing::info!(agents = ?running, "swarm permissions: manage_root_agent changed, restarting");
+    if let Err(e) = crate::job_queue::power::restart_many(coord, &running, true).await {
+        tracing::error!(agents = ?running, error = ?e, "swarm permissions: restart insert failed");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::path::Path;
+
+    use super::{Read, sync_with};
+    use swarm_queue_client::agent_permissions::AgentPermissions;
+
+    fn record(json: &str) -> AgentPermissions {
+        serde_json::from_str(json).expect("decodes")
+    }
+
+    fn agents() -> Vec<String> {
+        vec!["atlas".to_owned(), "ruth".to_owned()]
+    }
+
+    /// Sync `agents()` against `path` with each agent read as `answer` gives.
+    async fn sync(
+        path: &Path,
+        answer: impl Fn(&str) -> anyhow::Result<Read>,
+    ) -> anyhow::Result<Vec<String>> {
+        sync_with(&agents(), path, |agent| {
+            let out = answer(&agent);
+            async move { out }
+        })
+        .await
+    }
+
+    /// No key anywhere is everyone on the default: nothing stored, and no
+    /// restart, since that is what the agents already run with.
+    #[tokio::test]
+    async fn missing_keys_are_the_default_and_restart_nothing() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("p.json");
+        let changed = sync(&path, |_| Ok(Read::Current(AgentPermissions::default())))
+            .await
+            .expect("read");
+        assert!(changed.is_empty());
+        assert!(crate::permissions::read_at(&path).expect("read").is_empty());
+        assert!(
+            crate::permissions::holds(
+                &path,
+                "ruth",
+                hive_sh4re::permissions::Permission::ManageRootAgent
+            )
+            .expect("read")
+        );
+    }
+
+    /// Revoking ruth's default, and granting atlas, restarts both; clearing
+    /// them again restarts both back.
+    #[tokio::test]
+    async fn a_changed_manage_root_agent_asks_for_a_restart() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("p.json");
+        let changed = sync(&path, |agent| {
+            Ok(Read::Current(record(if agent == "ruth" {
+                r#"{"permissions":[]}"#
+            } else {
+                r#"{"permissions":["manage_root_agent"]}"#
+            })))
+        })
+        .await
+        .expect("read");
+        assert_eq!(changed, agents());
+
+        // The same answer again changes nothing.
+        let unchanged = sync(&path, |agent| {
+            Ok(Read::Current(record(if agent == "ruth" {
+                r#"{"permissions":[]}"#
+            } else {
+                r#"{"permissions":["manage_root_agent"]}"#
+            })))
+        })
+        .await
+        .expect("read");
+        assert!(unchanged.is_empty());
+
+        let cleared = sync(&path, |_| Ok(Read::Current(AgentPermissions::default())))
+            .await
+            .expect("read");
+        assert_eq!(cleared, agents());
+    }
+
+    /// A change that leaves `manage_root_agent` where it was is stored and
+    /// restarts nothing: the agent applies tool permissions itself.
+    #[tokio::test]
+    async fn a_tool_only_change_is_stored_without_a_restart() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("p.json");
+        let changed = sync(&path, |agent| {
+            Ok(Read::Current(if agent == "ruth" {
+                record(r#"{"permissions":["manage_root_agent"]}"#)
+            } else {
+                record(r#"{"permissions":["messaging","web_tools"]}"#)
+            }))
+        })
+        .await
+        .expect("read");
+        assert!(changed.is_empty());
+        assert!(
+            crate::permissions::read_at(&path)
+                .expect("read")
+                .contains_key("atlas")
+        );
+    }
+
+    /// One failed read, or a bucket that does not answer, keeps what was
+    /// stored and restarts nothing.
+    #[tokio::test]
+    async fn a_failed_read_keeps_the_last_value() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("p.json");
+        let revoked = || Ok(Read::Current(record(r#"{"permissions":[]}"#)));
+        // atlas holds no manage_root_agent either way, so only ruth changes.
+        assert_eq!(
+            sync(&path, |_| revoked()).await.expect("read"),
+            vec!["ruth".to_owned()]
+        );
+        let before = std::fs::read(&path).expect("stored");
+
+        sync(&path, |agent| {
+            if agent == "ruth" {
+                Err(anyhow::anyhow!("timed out"))
+            } else {
+                Ok(Read::Current(AgentPermissions::default()))
+            }
+        })
+        .await
+        .expect_err("a failed read fails the pass");
+        assert_eq!(std::fs::read(&path).expect("stored"), before);
+
+        let changed = sync(&path, |_| Ok(Read::NoBucket))
+            .await
+            .expect("no bucket");
+        assert!(changed.is_empty());
+        assert_eq!(std::fs::read(&path).expect("stored"), before);
+    }
+}
diff --git a/hive-host-sock/README.md b/hive-host-sock/README.md
index ec76badb..602d3af0 100644
--- a/hive-host-sock/README.md
+++ b/hive-host-sock/README.md
@@ -20,7 +20,7 @@ shared payload type some variants reference (`AgentStatusRow`) stays in
 client implementation.
 
 Its own `jobs` module is the exception: the job-queue vocabulary `hivectl`
-needs (`Source`, `State`, `PermPayload`, `NodeId`) is protocol-local. The typed
+needs (`State`, `NodeId`) is protocol-local. The typed
 `DagView`/`NodeView` projection that used to live there is gone — the queue is
 served as a generic graph (`hive-jobq-wire`), not as a second hand-written
 view.
diff --git a/hive-host-sock/src/jobs.rs b/hive-host-sock/src/jobs.rs
index 36f7048a..b9ac2265 100644
--- a/hive-host-sock/src/jobs.rs
+++ b/hive-host-sock/src/jobs.rs
@@ -1,6 +1,5 @@
-//! Vocabulary hive-c0re's job queue shares with its clients: what a
-//! permission change carries ([`PermPayload`]) and the scheduler's
-//! lifecycle [`State`].
+//! Vocabulary hive-c0re's job queue shares with its clients: the
+//! scheduler's lifecycle [`State`].
 //!
 //! A `Source` enum lived here too — where a job came from, rendered as the
 //! "why" chip. It was a field on the DAG container, and it went with it: a
@@ -15,27 +14,8 @@
 //! scheduling) live in `hive-c0re::job_queue`.
 //! Semantics: `docs/scheduler/coordinator.md::Job queue`.
 
-use serde::{Deserialize, Serialize};
-
 pub use hive_jobq::State;
 
-/// Kind-specific payload for `Template::PermChange` DAGs.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(tag = "type", rename_all = "snake_case")]
-pub enum PermPayload {
-    /// Set the tool groups for one agent (`tool-groups.json`).
-    ToolGroups { groups: Vec<String> },
-    /// Set the capabilities for one agent (`capabilities.json`).
-    Capabilities { caps: Vec<String> },
-    /// Set both perm-types in one entry — the batch
-    /// `POST /api/permissions` path. `None` leaves that file untouched;
-    /// present fields commit together and rebuild once.
-    Combined {
-        groups: Option<Vec<String>>,
-        caps: Option<Vec<String>>,
-    },
-}
-
 /// Node id. Carries the scheduler crate's globally-monotonic node id
 /// (`hive_jobq::NodeId`) verbatim on the wire — unique across all DAGs, not
 /// just within one. Consumers treat it opaquely (grouping + dep matching),
diff --git a/hive-sh4re/Cargo.toml b/hive-sh4re/Cargo.toml
index 04e98e91..0ade61b6 100644
--- a/hive-sh4re/Cargo.toml
+++ b/hive-sh4re/Cargo.toml
@@ -16,7 +16,3 @@ serde.workspace = true
 # `stream_enrich` walks raw claude `stream-json` values into `term_msg` rows.
 serde_json.workspace = true
 strum.workspace = true
-# Facade only, for the one warn in `permissions::ToolGroup::parse_list`: an
-# unknown tool-group name is skipped rather than fatal, so the log line is the
-# only trace it leaves.
-tracing.workspace = true
diff --git a/hive-sh4re/src/permissions.rs b/hive-sh4re/src/permissions.rs
index 88247574..2c08fced 100644
--- a/hive-sh4re/src/permissions.rs
+++ b/hive-sh4re/src/permissions.rs
@@ -1,37 +1,32 @@
-//! Per-agent authorization: named MCP-tool groups (`ToolGroup`) and
-//! system-level capability grants (`Capability`). Both are declared in
-//! per-agent config (`tool-groups.json` / `capabilities.json`), injected
-//! into the container as env vars, and read by the harness to decide
-//! which MCP tools claude actually sees.
+//! Per-agent authorization: the one [`Permission`] set an agent holds.
 //!
-//! It also resolves the *built-in* claude tool list ([`builtin_tools_arg`]):
-//! that set is group-gated too (`web_tools`), so it belongs next to the
-//! groups rather than in any one consumer. Both processes that spawn a
-//! `claude` — the harness itself and the subagent daemon — call the same
-//! function, so a subagent can never be handed a built-in its parent does
-//! not have — with one deliberate exception: [`subagent_builtin_tools_arg`]
-//! additionally grants a **subagent** Claude's own `Bash` when the parent
-//! holds [`ToolGroup::Execution`]. The parent never gets built-in `Bash`
-//! itself (it has the out-of-process `bash` MCP server instead); the
-//! capability transfers to a subagent, not the mechanism.
-
-use std::str::FromStr;
+//! The set lives in the swarm's `agent-permissions` record
+//! (`swarm_queue_client::agent_permissions`), one list per agent. Each member
+//! is enforced where it applies: the MCP-tool and built-in-tool members by
+//! the processes that spawn `claude` (the agent harness and the subagent
+//! daemon), [`Permission::ManageRootAgent`] by hive-c0re's bind mounts. An
+//! agent the swarm sets nothing for holds [`Permission::default_for`].
+//!
+//! It also resolves the *built-in* claude tool list ([`builtin_tools_for`]):
+//! that set is permission-gated too (`web_tools`), so it belongs here rather
+//! than in any one consumer. Both processes that spawn a `claude` call the
+//! same function, so a subagent can never be handed a built-in its parent
+//! does not have — with one deliberate exception:
+//! [`subagent_builtin_tools_for`] additionally grants a **subagent** Claude's
+//! own `Bash` when the parent holds [`Permission::Execution`]. The parent
+//! never gets built-in `Bash` itself (it has the out-of-process `bash` MCP
+//! server instead); the permission transfers to a subagent, not the
+//! mechanism.
 
 use serde::{Deserialize, Serialize};
 
-/// Env var the meta renderer writes with a comma-separated list of
-/// [`ToolGroup`] `snake_case` names (e.g. `"messaging,inbox,meta"`). Absent
-/// or unparseable means [`ToolGroup::AGENT_DEFAULT`]. See
-/// `docs/process/conventions.md::Tool groups`.
-pub const TOOL_GROUPS_ENV: &str = "HIVE_TOOL_GROUPS";
-
-/// Built-in claude tools present in every session regardless of tool
-/// groups. Anything not in this list (and not added by a group's
-/// [`ToolGroup::builtin_tools`]) literally doesn't exist in the session —
+/// Built-in claude tools present in every session regardless of permissions.
+/// Anything not in this list (and not added by a permission's
+/// [`Permission::builtin_tools`]) literally doesn't exist in the session —
 /// this is the `--tools` list, which holds even under
 /// `--dangerously-skip-permissions`.
 ///
-/// Web egress (`WebFetch`/`WebSearch`) is group-gated (`web_tools`) and so
+/// Web egress (`WebFetch`/`WebSearch`) is permission-gated (`web_tools`) and so
 /// lives there, off by default. Nested agents (`Task`/`Agent`) are
 /// intentionally omitted. `Bash` is disallowed — shell execution goes
 /// through `mcp__bash__run` (background tasks with structured output via
@@ -45,23 +40,24 @@ pub const TOOL_GROUPS_ENV: &str = "HIVE_TOOL_GROUPS";
 /// matches the task at hand.
 pub const ALLOWED_BUILTIN_TOOLS: &[&str] = &["Edit", "Glob", "Grep", "Read", "Skill", "Write"];
 
-/// The tool groups in effect for this process, from [`TOOL_GROUPS_ENV`].
+/// The built-in claude tools `perms` resolve to: [`ALLOWED_BUILTIN_TOOLS`]
+/// plus each permission's own built-ins, de-duplicated, base set first.
 ///
-/// Absent, blank, or naming nothing recognisable all fall back to
-/// [`ToolGroup::AGENT_DEFAULT`] — the var is written per agent by the meta
-/// renderer, so "unset" is an ordinary state, not an error.
+/// ⚠️ The result is a claude `--tools` value once joined, and must **never be
+/// empty** — not because of what an empty value does, but because we don't
+/// know. Our own measurement and the installed `claude --help` disagree about
+/// whether `--tools ""` means "no tools" or parses as the flag being unset,
+/// and the answer is a property of whichever claude release is installed.
+/// [`ALLOWED_BUILTIN_TOOLS`] is non-empty, which keeps the case from arising.
+///
+/// ⚠️ This governs built-ins only. `mcp__*` tools are not filtered by
+/// `--tools` at all; they are governed by `--strict-mcp-config` plus
+/// whatever the caller renders into `--mcp-config`.
 #[must_use]
-pub fn effective_tool_groups() -> Vec<ToolGroup> {
-    ToolGroup::parse_list(&std::env::var(TOOL_GROUPS_ENV).unwrap_or_default())
-}
-
-/// The built-in claude tools `groups` resolve to: [`ALLOWED_BUILTIN_TOOLS`]
-/// plus each group's own built-ins, de-duplicated, base set first.
-#[must_use]
-pub fn builtin_tools_for(groups: &[ToolGroup]) -> Vec<&'static str> {
+pub fn builtin_tools_for(perms: &[Permission]) -> Vec<&'static str> {
     let mut tools: Vec<&'static str> = ALLOWED_BUILTIN_TOOLS.to_vec();
-    for group in groups {
-        for tool in group.builtin_tools() {
+    for perm in perms {
+        for tool in perm.builtin_tools() {
             if !tools.contains(tool) {
                 tools.push(tool);
             }
@@ -70,205 +66,131 @@ pub fn builtin_tools_for(groups: &[ToolGroup]) -> Vec<&'static str> {
     tools
 }
 
-/// The value for claude's `--tools` flag: which built-in tools exist in this
-/// session at all.
-///
-/// ⚠️ **Never emit this as an empty string** — not because of what an empty
-/// value does, but because we don't know. Our own measurement and the
-/// installed `claude --help` disagree about whether `--tools ""` means "no
-/// tools" or parses as the flag being unset, and the answer is a property of
-/// whichever claude release is installed, not of this code. So an empty
-/// value is refused rather than relied on: the rule holds under either
-/// reading, and no caller has to know which one is true today.
-/// [`ALLOWED_BUILTIN_TOOLS`] is non-empty, which keeps the case from
-/// arising in the first place.
-///
-/// ⚠️ This governs built-ins only. `mcp__*` tools are not filtered by
-/// `--tools` at all; they are governed by `--strict-mcp-config` plus
-/// whatever the caller renders into `--mcp-config`.
-#[must_use]
-pub fn builtin_tools_arg() -> String {
-    builtin_tools_for(&effective_tool_groups()).join(",")
-}
-
-/// [`builtin_tools_for`] plus Claude's built-in `Bash`, granted iff `groups`
-/// contains [`ToolGroup::Execution`] — the **subagent**-only `--tools`
+/// [`builtin_tools_for`] plus Claude's built-in `Bash`, granted iff `perms`
+/// contains [`Permission::Execution`] — the **subagent**-only `--tools`
 /// resolution.
 ///
 /// `Execution` already grants shell execution to the parent agent, via the
 /// out-of-process `bash` MCP server (`mcp__bash__run`/`status`/`kill` —
 /// see the variant's own doc comment). A subagent has no MCP server at all
 /// by default (`docs/tools/subagent.md`), so there is no `mcp__bash__*` for
-/// it to inherit that capability through; it gets Claude's own `Bash`
-/// instead. The capability transfers from the parent, the mechanism it
-/// arrives by does not have to match.
+/// it to inherit that permission through; it gets Claude's own `Bash`
+/// instead.
 ///
-/// 🩸 Deliberately **not** folded into [`builtin_tools_for`]/[`ToolGroup::builtin_tools`]:
-/// those are shared with the harness's own `--tools` (`hive-agent`'s
-/// `mcp_config::allowed_tools_arg`), and the main agent must never gain
-/// built-in `Bash` no matter which groups it holds — only a *subagent*
-/// spawned by an `Execution`-holding parent does.
+/// 🩸 Deliberately **not** folded into [`builtin_tools_for`]/[`Permission::builtin_tools`]:
+/// those are shared with the harness's own `--tools`, and the main agent must
+/// never gain built-in `Bash` no matter which permissions it holds — only a
+/// *subagent* spawned by an `Execution`-holding parent does.
 #[must_use]
-pub fn subagent_builtin_tools_for(groups: &[ToolGroup]) -> Vec<&'static str> {
-    let mut tools = builtin_tools_for(groups);
-    if groups.contains(&ToolGroup::Execution) {
+pub fn subagent_builtin_tools_for(perms: &[Permission]) -> Vec<&'static str> {
+    let mut tools = builtin_tools_for(perms);
+    if perms.contains(&Permission::Execution) {
         tools.push("Bash");
     }
     tools
 }
 
-/// The value for a **subagent's** `--tools` flag: [`subagent_builtin_tools_for`]
-/// resolved against [`effective_tool_groups`]. See that function for why this
-/// differs from [`builtin_tools_arg`].
-#[must_use]
-pub fn subagent_builtin_tools_arg() -> String {
-    subagent_builtin_tools_for(&effective_tool_groups()).join(",")
-}
-
-/// Named group of MCP tools an agent may be granted. The harness reads
-/// `HIVE_TOOL_GROUPS` from the environment (a comma-separated list of
-/// `snake_case` group names written by the meta renderer from per-agent
-/// config) and expands it to the matching tool names for `--allowedTools`.
-/// When the env var is absent the harness falls back to `AGENT_DEFAULT`.
-/// See `docs/process/conventions.md::Tool groups`.
-#[derive(
-    Debug,
-    Clone,
-    Copy,
-    PartialEq,
-    Eq,
-    Hash,
-    Serialize,
-    Deserialize,
-    strum::IntoStaticStr,
-    strum::EnumString,
-)]
+/// One thing an agent may be permitted. Stored by its `snake_case` name.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, strum::IntoStaticStr)]
 #[serde(rename_all = "snake_case")]
 #[strum(serialize_all = "snake_case")]
-pub enum ToolGroup {
+pub enum Permission {
     /// `send`, `recv`, `ack_until`
     Messaging,
     /// `get_agent_meta` (`set_status` is always-on — see `ALWAYS_ON_TOOLS`)
     Meta,
     /// `get_loose_ends`, `cancel_loose_end`, `remind`
     Inbox,
-    /// Gates no tool today — `list_containers`, its only member, was
-    /// removed with no replacement. Kept so existing
-    /// `meta/capabilities.json` grants still parse; `tools()` returns
-    /// `&[]`.
-    Lifecycle,
-    /// Gates no tool today — `create_repo`, its only member, was removed
-    /// with no replacement. Kept so existing `meta/capabilities.json`
-    /// grants still parse; `tools()` returns `&[]`.
-    Forge,
     /// Gates whether the `bash` MCP server (`mcp__bash__run`/`status`/
     /// `kill`) is rendered into the agent's config at all — see
-    /// `extra_server_required_group` in `hive-agent/src/mcp_config.rs`.
+    /// `extra_server_required_permission` in `hive-agent/src/mcp_config.rs`.
     /// `tools()` returns `&[]`: this isn't a `mcp__hyperhive__*`
     /// allowlist entry, the gate lives at config-render time instead.
     Execution,
     /// Claude built-in web egress tools: `WebFetch` (retrieve a URL) and
-    /// `WebSearch` (search the web). Both are omitted from `--tools` by
-    /// default; adding this group to an agent enables them in the session
-    /// and in `--allowedTools` so they run without a confirmation prompt.
-    /// Does not gate any MCP tools — `tools()` returns `&[]`.
+    /// `WebSearch` (search the web). Both are omitted from `--tools`
+    /// without it; holding it enables them in the session and in
+    /// `--allowedTools` so they run without a confirmation prompt.
     WebTools,
+    /// Agent may manage *any* agent in the hive. Concretely, hive-c0re
+    /// bind-mounts every agent's state dir (RW) and config dir (RO) into the
+    /// holder's container, plus `/applied` and `/meta` read-only, so the
+    /// holder can recover an agent that is down. See
+    /// `lifecycle::host_config::set_nspawn_flags`.
+    ///
+    /// The name is historical, from when "the root agent" was the widest
+    /// thing to manage. Kept under that spelling because every stored grant
+    /// carries it.
+    ManageRootAgent,
 }
 
-impl ToolGroup {
-    /// Parse a comma-separated [`TOOL_GROUPS_ENV`] value. Tokens are trimmed
-    /// and lowercased; an unrecognised one is warned about and skipped
-    /// rather than failing the whole list, so one stale name in an agent's
-    /// config can't take its whole tool surface away.
-    ///
-    /// Returns [`AGENT_DEFAULT`](Self::AGENT_DEFAULT) when `raw` is blank or
-    /// names nothing recognisable — the same fallback either way, because
-    /// "the operator granted no groups" and "the var is missing" are not
-    /// distinguishable here and neither should mean "no tools".
+impl Permission {
+    /// Every permission in a stable order.
+    pub const ALL: &'static [Self] = &[
+        Self::Messaging,
+        Self::Meta,
+        Self::Inbox,
+        Self::Execution,
+        Self::WebTools,
+        Self::ManageRootAgent,
+    ];
+
+    /// What an agent the swarm sets nothing for holds.
+    pub const DEFAULT: &'static [Self] =
+        &[Self::Messaging, Self::Meta, Self::Inbox, Self::Execution];
+
+    /// What `agent` holds when the swarm sets nothing for it: [`Self::DEFAULT`],
+    /// plus [`Self::ManageRootAgent`] for the root agent
+    /// ([`crate::manager::MANAGER_AGENT`]), which recovers the others.
     #[must_use]
-    pub fn parse_list(raw: &str) -> Vec<Self> {
-        let mut groups = Vec::new();
-        for token in raw.split(',') {
-            let token = token.trim().to_ascii_lowercase();
-            if token.is_empty() {
-                continue;
-            }
-            match Self::from_str(&token) {
-                Ok(group) => groups.push(group),
-                Err(_) => {
-                    tracing::warn!(token = %token, "{TOOL_GROUPS_ENV}: unknown tool group, skipping");
-                }
-            }
+    pub fn default_for(agent: &str) -> Vec<Self> {
+        let mut perms = Self::DEFAULT.to_vec();
+        if agent == crate::manager::MANAGER_AGENT {
+            perms.push(Self::ManageRootAgent);
         }
-        if groups.is_empty() {
-            if !raw.trim().is_empty() {
-                tracing::warn!(
-                    "{TOOL_GROUPS_ENV} set but contained no recognised groups; \
-                     falling back to AGENT_DEFAULT"
-                );
-            }
-            return Self::AGENT_DEFAULT.to_vec();
-        }
-        groups
+        perms
     }
 
-    /// The MCP tool names (without the `mcp__hyperhive__` prefix) in this group.
-    /// Returns `&[]` for `WebTools` (it enables Claude built-in tools, not MCP
-    /// tools — see `builtin_tools()`) and for `Lifecycle` / `Forge` (their
-    /// tools were removed); see each variant's doc comment.
+    /// The MCP tool names (without the `mcp__hyperhive__` prefix) this
+    /// permission grants. Empty for the permissions that grant something
+    /// else; see each variant's doc comment.
     #[must_use]
     pub fn tools(self) -> &'static [&'static str] {
         match self {
             Self::Messaging => &["send", "recv", "ack_until"],
             Self::Meta => &["get_agent_meta"],
             Self::Inbox => &["get_loose_ends", "cancel_loose_end", "remind"],
-            // All four empty, for different reasons — see each
-            // variant's own doc comment above. `Execution` grants the
-            // out-of-process `bash` MCP server
-            // (`mcp__bash__run`/`status`/`kill`), gated at config-render
-            // time by `extra_server_required_group` in
-            // `hive-agent/src/mcp_config.rs`, not by this list — an
-            // out-of-process server has no later enforcement point, so
-            // that gate is the actual security boundary. `WebTools`
-            // grants Claude built-in tools, not MCP ones; see
-            // `builtin_tools()`. `Lifecycle` and `Forge` each listed
-            // exactly one tool — `list_containers` and `create_repo`
-            // respectively — and both tools were removed outright; the
-            // variants stay so existing grants parse.
-            Self::Lifecycle | Self::Forge | Self::Execution | Self::WebTools => &[],
+            // `Execution` grants the out-of-process `bash` MCP server,
+            // gated at config-render time in `hive-agent/src/mcp_config.rs`
+            // — an out-of-process server has no later enforcement point, so
+            // that gate is the actual security boundary. `WebTools` grants
+            // Claude built-ins (`builtin_tools()`); `ManageRootAgent` grants
+            // bind mounts.
+            Self::Execution | Self::WebTools | Self::ManageRootAgent => &[],
         }
     }
 
-    /// MCP tools that are always exposed regardless of which tool groups an
-    /// agent is granted. `set_status` lives here because the operator
+    /// MCP tools that are always exposed regardless of which permissions an
+    /// agent holds. `set_status` lives here because the operator
     /// dashboard depends on every agent being able to report its status
-    /// chip — gating it behind a group would let a misconfigured agent go
-    /// dark on the dashboard. The server-side `SetStatus` handler has no
-    /// tool-group check either (only length validation), so listing it here
-    /// keeps the `--allowedTools` list honest with that reality.
+    /// chip — gating it would let a misconfigured agent go dark on the
+    /// dashboard. The server-side `SetStatus` handler has no permission
+    /// check either (only length validation), so listing it here keeps the
+    /// `--allowedTools` list honest with that reality.
     ///
     /// `compact` lives here too: it's pure self-management (no cross-agent
-    /// effect, no privilege), gated server-side on context usage rather
-    /// than on tool groups, and every agent should be able to reach for it
-    /// regardless of which optional groups it's been granted — same
-    /// reasoning as `set_status`.
+    /// effect, no privilege), gated server-side on context usage, and every
+    /// agent should be able to reach for it — same reasoning as `set_status`.
     ///
-    /// `mark_todos_done` too (a critical bug every agent hit): it was
-    /// declared as a `#[tool]` fn but never added to *any*
-    /// group's [`tools`](Self::tools), including `Inbox`, so no agent could
-    /// ever get it into `--allowedTools` and every call prompted for
-    /// approval it can't get. Todos are pushed to an agent independent of
-    /// whether it holds `Inbox` (that group only gates
-    /// `get_loose_ends`/`cancel_loose_end`/`remind`), so an agent without
-    /// `Inbox` could accumulate todos it can never clear — same
-    /// "every agent needs this regardless of optional groups" shape as
-    /// `set_status`/`compact`, not a narrower `Inbox`-only fix.
+    /// `mark_todos_done` too: todos are pushed to an agent whether or not it
+    /// holds `Inbox` (which only gates `get_loose_ends`/`cancel_loose_end`/
+    /// `remind`), so an agent without `Inbox` must still be able to clear
+    /// them.
     pub const ALWAYS_ON_TOOLS: &'static [&'static str] =
         &["set_status", "compact", "mark_todos_done"];
 
-    /// The Claude built-in tool names enabled by this group. Only
-    /// `WebTools` returns a non-empty slice; all other groups return `&[]`
-    /// (they control MCP tools via `tools()` instead).
+    /// The Claude built-in tool names this permission enables. Only
+    /// `WebTools` returns a non-empty slice.
     #[must_use]
     pub fn builtin_tools(self) -> &'static [&'static str] {
         match self {
@@ -276,179 +198,91 @@ impl ToolGroup {
             _ => &[],
         }
     }
-
-    /// Default tool groups for an agent harness. Used when `HIVE_TOOL_GROUPS` is unset.
-    pub const AGENT_DEFAULT: &'static [Self] =
-        &[Self::Messaging, Self::Meta, Self::Inbox, Self::Execution];
-
-    /// Convenience preset for a fully-privileged agent (all groups).
-    /// Use this as a starting point in `tool-groups.json` for root/manager agents.
-    pub const MANAGER_DEFAULT: &'static [Self] = &[
-        Self::Messaging,
-        Self::Meta,
-        Self::Inbox,
-        Self::Lifecycle,
-        Self::Execution,
-    ];
-
-    /// Every known tool group in a stable order. Use this to enumerate
-    /// columns in the capabilities UI or any other place that needs the
-    /// full list without hard-coding it at the call site.
-    pub const ALL: &'static [Self] = &[
-        Self::Messaging,
-        Self::Meta,
-        Self::Inbox,
-        Self::Lifecycle,
-        Self::Forge,
-        Self::Execution,
-        Self::WebTools,
-    ];
-
-    /// Short human-readable description suitable for a tooltip or help text.
-    #[must_use]
-    pub fn description(self) -> &'static str {
-        match self {
-            Self::Messaging => "send, recv, ack_until — core agent communication",
-            Self::Meta => {
-                "get_agent_meta — identity introspection (set_status is always available)"
-            }
-            Self::Inbox => "get_loose_ends, cancel_loose_end, remind — self-scheduling",
-            Self::Lifecycle => "no tools — vestigial since list_containers was removed",
-            Self::Forge => "no tools — vestigial since create_repo was removed",
-            Self::Execution => {
-                "run, status — run shell commands via mcp__bash__run / mcp__bash__status"
-            }
-            Self::WebTools => "WebFetch, WebSearch — Claude built-in web egress; not MCP tools",
-        }
-    }
-}
-
-/// Per-agent capability grants. Stored in `meta/capabilities.json`
-/// (same shape as `tool-groups.json`: `{ "alice": ["manage_root_agent"] }`).
-/// Capabilities control system-level access hive-c0re enforces at
-/// dispatch time; they are orthogonal to tool groups (which control
-/// which MCP tools the harness exposes to claude).
-///
-/// Injected into containers as `HIVE_CAPABILITIES` (comma-separated
-/// `snake_case`) via `meta::render_flake`. The harness reads this to
-/// conditionally register capability-gated MCP tools so claude only
-/// sees tools it can actually invoke. See `docs/process/conventions.md::Capabilities`.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, strum::IntoStaticStr)]
-#[serde(rename_all = "snake_case")]
-#[strum(serialize_all = "snake_case")]
-pub enum Capability {
-    /// Agent may manage *any* agent in the hive, not just its own
-    /// children. Concretely, hive-c0re bind-mounts every agent's state
-    /// dir (RW) and config dir (RO) into the holder's container, plus
-    /// `/applied` and `/meta` read-only, so the holder can recover an
-    /// agent that is down. See `lifecycle::host_config::set_nspawn_flags`.
-    ///
-    /// The name is historical: it was minted when the hive had a parent/
-    /// child topology and "manage the root agent" was the widest grant
-    /// there was. With the hierarchy removed there is no privileged root
-    /// to single out, so the same grant now means "manage any agent".
-    /// Kept under the old spelling deliberately — renaming it would turn
-    /// every `manage_root_agent` already stored in `capabilities.json`
-    /// into an unrecognised name that `capabilities::prune_unknown`
-    /// silently drops.
-    ManageRootAgent,
-}
-
-impl Capability {
-    /// Every known capability in a stable order. Use this to enumerate
-    /// columns in the permissions UI or validate incoming capability strings.
-    pub const ALL: &'static [Self] = &[Self::ManageRootAgent];
-
-    /// Short human-readable description suitable for a tooltip or help text.
-    #[must_use]
-    pub fn description(self) -> &'static str {
-        match self {
-            Self::ManageRootAgent => {
-                "manage any agent: every agent's state (rw) and config (ro) mounted for recovery"
-            }
-        }
-    }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    /// The env-var spellings the meta renderer actually writes must round-trip
-    /// back to groups. `strum::EnumString` and serde's `rename_all` are two
-    /// independent derives over the same names; this pins them together, since
-    /// the renderer writes what serde would produce and the parse is strum's.
+    /// The stored names are the `snake_case` spellings the old tool-group
+    /// and capability files used, so an imported grant decodes.
     #[test]
-    fn parse_list_accepts_the_snake_case_names_the_renderer_writes() {
+    fn stored_names_are_snake_case() {
+        let names: Vec<&str> = Permission::ALL.iter().map(|p| <&str>::from(*p)).collect();
         assert_eq!(
-            ToolGroup::parse_list("messaging, Meta ,web_tools"),
-            vec![ToolGroup::Messaging, ToolGroup::Meta, ToolGroup::WebTools]
+            names,
+            [
+                "messaging",
+                "meta",
+                "inbox",
+                "execution",
+                "web_tools",
+                "manage_root_agent"
+            ]
         );
-        for group in ToolGroup::ALL {
-            let name: &'static str = (*group).into();
-            assert_eq!(ToolGroup::parse_list(name), vec![*group], "{name}");
+        for perm in Permission::ALL {
+            let json = serde_json::to_string(perm).unwrap();
+            assert_eq!(json, format!("\"{}\"", <&str>::from(*perm)));
         }
+        assert!(serde_json::from_str::<Permission>("\"lifecycle\"").is_err());
     }
 
-    /// Blank, absent and all-garbage are the same state as far as the tool
-    /// surface is concerned: the default groups, never an empty list.
     #[test]
-    fn parse_list_falls_back_to_the_agent_default_rather_than_nothing() {
-        for raw in ["", "   ", ",,", "not_a_group,also_not"] {
-            assert_eq!(
-                ToolGroup::parse_list(raw),
-                ToolGroup::AGENT_DEFAULT.to_vec(),
-                "{raw:?}"
-            );
-        }
+    fn only_the_root_agent_defaults_to_managing_the_others() {
+        assert_eq!(
+            Permission::default_for("atlas"),
+            Permission::DEFAULT.to_vec()
+        );
+        let ruth = Permission::default_for(crate::manager::MANAGER_AGENT);
+        assert!(ruth.contains(&Permission::ManageRootAgent));
+        assert_eq!(&ruth[..Permission::DEFAULT.len()], Permission::DEFAULT);
     }
 
-    /// Adding groups only ever adds built-ins — the base set is in every
-    /// resolution, and no group can remove one. Both `--tools` callers (the
+    /// Adding permissions only ever adds built-ins — the base set is in every
+    /// resolution, and no permission can remove one. Both `--tools` callers (the
     /// harness and the subagent daemon) rely on this to reason about "the
     /// parent's set" without re-deriving it.
     #[test]
-    fn builtin_tools_are_the_base_set_plus_whatever_the_groups_add() {
+    fn builtin_tools_are_the_base_set_plus_whatever_the_permissions_add() {
         assert_eq!(
             builtin_tools_for(&[]),
             ALLOWED_BUILTIN_TOOLS.to_vec(),
-            "no groups resolves to exactly the base set"
+            "no permissions resolves to exactly the base set"
         );
         assert_eq!(
-            builtin_tools_for(ToolGroup::AGENT_DEFAULT),
+            builtin_tools_for(Permission::DEFAULT),
             ALLOWED_BUILTIN_TOOLS.to_vec(),
-            "the default groups add no built-ins"
+            "the default permissions add no built-ins"
         );
-        for group in ToolGroup::ALL {
-            let resolved = builtin_tools_for(&[*group]);
+        for perm in Permission::ALL {
+            let resolved = builtin_tools_for(&[*perm]);
             for base in ALLOWED_BUILTIN_TOOLS {
-                assert!(resolved.contains(base), "{group:?} dropped {base}");
+                assert!(resolved.contains(base), "{perm:?} dropped {base}");
             }
         }
     }
 
-    /// `web_tools` is the one group that widens the built-in set, and it is
+    /// `web_tools` is the one permission that widens the built-in set, and it is
     /// opt-in. A subagent inherits this resolution rather than a list of its
     /// own precisely so it cannot get web egress from a parent without the
-    /// group.
+    /// permission.
     #[test]
-    fn web_egress_is_present_only_with_the_web_tools_group() {
-        let with = builtin_tools_for(&[ToolGroup::WebTools]);
+    fn web_egress_is_present_only_with_the_web_tools_permission() {
+        let with = builtin_tools_for(&[Permission::WebTools]);
         assert!(with.contains(&"WebFetch") && with.contains(&"WebSearch"));
-        let without = builtin_tools_for(ToolGroup::MANAGER_DEFAULT);
+        let without = builtin_tools_for(Permission::DEFAULT);
         assert!(!without.contains(&"WebFetch") && !without.contains(&"WebSearch"));
     }
 
     /// No resolution may produce an empty `--tools` value. What an empty one
-    /// means is disputed and release-dependent (see [`builtin_tools_arg`]),
+    /// means is disputed and release-dependent (see [`builtin_tools_for`]),
     /// so this pins the rule that makes the question moot rather than any
     /// answer to it.
     #[test]
-    fn no_group_combination_resolves_to_an_empty_tools_arg() {
+    fn no_permission_combination_resolves_to_an_empty_tools_arg() {
         assert!(!ALLOWED_BUILTIN_TOOLS.is_empty());
         assert!(!builtin_tools_for(&[]).is_empty());
-        assert!(!builtin_tools_for(ToolGroup::ALL).is_empty());
-        assert!(!builtin_tools_arg().is_empty());
+        assert!(!builtin_tools_for(Permission::ALL).is_empty());
     }
 
     /// Built-ins are not MCP tools and the two lists must not be mixed: a
@@ -456,7 +290,7 @@ mod tests {
     /// does not filter the MCP surface at all.
     #[test]
     fn the_builtin_list_names_no_mcp_tools() {
-        for tool in builtin_tools_for(ToolGroup::ALL) {
+        for tool in builtin_tools_for(Permission::ALL) {
             assert!(!tool.contains("__"), "{tool} looks like an MCP tool name");
         }
     }
@@ -467,7 +301,7 @@ mod tests {
     /// inherit that through, so it gets Claude's built-in tool instead.
     #[test]
     fn subagent_gets_bash_when_parent_has_execution() {
-        let tools = subagent_builtin_tools_for(&[ToolGroup::Execution]);
+        let tools = subagent_builtin_tools_for(&[Permission::Execution]);
         assert!(tools.contains(&"Bash"));
     }
 
@@ -476,24 +310,27 @@ mod tests {
     /// grants it unconditionally would go unnoticed.
     #[test]
     fn subagent_gets_no_bash_without_execution() {
-        for groups in [&[][..], &[ToolGroup::Messaging, ToolGroup::WebTools][..]] {
-            let tools = subagent_builtin_tools_for(groups);
-            assert!(!tools.contains(&"Bash"), "{groups:?} must not grant Bash");
+        for permissions in [&[][..], &[Permission::Messaging, Permission::WebTools][..]] {
+            let tools = subagent_builtin_tools_for(permissions);
+            assert!(
+                !tools.contains(&"Bash"),
+                "{permissions:?} must not grant Bash"
+            );
         }
     }
 
-    /// The parent (harness) resolver is untouched: `builtin_tools_for` /
-    /// `builtin_tools_arg` — what `hive-agent`'s own `--tools` and
+    /// The parent (harness) resolver is untouched: `builtin_tools_for` —
+    /// what `hive-agent`'s own `--tools` and
     /// `--allowedTools` are built from — never produce `Bash`, with or
     /// without `Execution`. Only the subagent-specific resolver above adds
     /// it; the operator's ruling was explicit that the main agent does not.
     #[test]
     fn parent_resolver_never_gains_bash() {
-        for groups in [&[][..], &[ToolGroup::Execution][..], ToolGroup::ALL] {
-            let tools = builtin_tools_for(groups);
+        for permissions in [&[][..], &[Permission::Execution][..], Permission::ALL] {
+            let tools = builtin_tools_for(permissions);
             assert!(
                 !tools.contains(&"Bash"),
-                "{groups:?} must not grant Bash to the parent"
+                "{permissions:?} must not grant Bash to the parent"
             );
         }
     }
diff --git a/hive-subagent-mcp/Cargo.toml b/hive-subagent-mcp/Cargo.toml
index add83cb1..bd5c8e46 100644
--- a/hive-subagent-mcp/Cargo.toml
+++ b/hive-subagent-mcp/Cargo.toml
@@ -16,7 +16,7 @@ clap.workspace = true
 hive-agent-sock.workspace = true
 hive-claude.workspace = true
 hive-runtime.workspace = true
-# `permissions::builtin_tools_arg` — the same `--tools` resolution the parent
+# `permissions::subagent_builtin_tools_for` — the same `--tools` resolution the parent
 # harness spawns its own claude with, so a subagent's built-in surface is its
 # parent's rather than a second list that drifts. See `session::build_config`.
 # Also `term_msg`/`stream_enrich`, the rows `swarm_term` publishes.
@@ -30,7 +30,10 @@ serde.workspace = true
 serde_json.workspace = true
 # `subagent_term`: the subject each subagent's rows are published on.
 # `agent-inference`: this agent's `subagent_models`, read with one direct get.
-swarm-queue-client = { workspace = true, features = ["agent-inference"] }
+swarm-queue-client = { workspace = true, features = [
+  "agent-inference",
+  "agent-permissions",
+] }
 # The agent's own queue credential, read under its store identity.
 swarm-secret-client.workspace = true
 tokio.workspace = true
diff --git a/hive-subagent-mcp/src/session.rs b/hive-subagent-mcp/src/session.rs
index 202be430..6231dec6 100644
--- a/hive-subagent-mcp/src/session.rs
+++ b/hive-subagent-mcp/src/session.rs
@@ -98,7 +98,7 @@ use hive_claude::{Attach, Claude, Config, SessionStore};
 use hive_runtime::{
     AcpCommand, AcpRuntime, PermissionAsk, PermissionPolicy, Runtime as _, RuntimeSpec, TurnStop,
 };
-use hive_sh4re::permissions::ToolGroup;
+use hive_sh4re::permissions::Permission;
 use swarm_queue_client::agent_inference::AgentInference;
 use tokio::sync::oneshot;
 
@@ -552,12 +552,16 @@ impl State {
         command
     }
 
-    /// Read the swarm's key once, refuse a `model` outside the list in effect
-    /// for this agent (see `check_model`), and return the subagent cap in
-    /// effect (see `subagent_cap`).
+    /// Read the swarm's keys once: refresh this agent's permissions (the
+    /// tools the subagent about to run gets), refuse a `model` outside the list
+    /// in effect for this agent (see `check_model`), and return the subagent
+    /// cap in effect (see `subagent_cap`).
     async fn swarm_limits(&self, model: Option<&str>) -> anyhow::Result<Option<u32>> {
         let read = match &self.models {
-            Some(reader) => Some(reader.read().await),
+            Some(reader) => {
+                reader.refresh_permissions().await;
+                Some(reader.read().await)
+            }
             None => None,
         };
         let agent = self
@@ -1051,7 +1055,7 @@ fn validate_name(name: &str) -> anyhow::Result<()> {
 
 /// Env var carrying the nix-configured `services.hyperhive.agent.availableModels` as a
 /// comma-separated list, forwarded onto this daemon's unit by
-/// `nix/agent-modules/mcp.nix` the same way `HIVE_TOOL_GROUPS` is.
+/// `nix/agent-modules/mcp.nix` from the harness unit.
 const AVAILABLE_MODELS_ENV: &str = "HIVE_AVAILABLE_MODELS";
 
 /// The models this daemon may spawn a subagent on, from
@@ -1136,7 +1140,7 @@ fn check_model(model: Option<&str>, list: &ModelList) -> anyhow::Result<()> {
             "the swarm's subagent_models for this agent",
         ),
         ModelList::Local(None) => return Ok(()),
-        // Same split/trim/skip-empty rules as `ToolGroup::parse_list`.
+        // Split, trim, skip empty tokens.
         ModelList::Local(Some(env)) => (
             env.split(',')
                 .map(str::trim)
@@ -1186,7 +1190,8 @@ fn subagent_otel_attrs(name: &str) -> String {
 /// gates covering one half each, neither substituting for the other:
 /// `strict_mcp_config` over **MCP** tools (no ambient discovery, so exactly
 /// what [`crate::mcp_config::build`] renders), `--tools` over **built-in**
-/// ones, via [`hive_sh4re::permissions::subagent_builtin_tools_arg`], which
+/// ones, via [`hive_sh4re::permissions::subagent_builtin_tools_for`] over the
+/// agent's permissions ([`crate::swarm_models::permissions_now`]), which
 /// documents its one `Bash` exception. `--tools` does not filter `mcp__*`,
 /// so the signal tools are unnamed in it (`docs/tools/subagent.md`).
 ///
@@ -1208,10 +1213,13 @@ fn build_config(
     dir: Option<&str>,
     signal_url: Option<&str>,
 ) -> Config {
-    let tools = hive_sh4re::permissions::subagent_builtin_tools_arg();
+    let tools = hive_sh4re::permissions::subagent_builtin_tools_for(
+        &crate::swarm_models::permissions_now(),
+    )
+    .join(",");
     // Refuse to spawn on an empty `--tools` rather than reason about what it
     // would do: what an empty value means is disputed and depends on the
-    // installed claude release (see `builtin_tools_arg`). Nothing here wants
+    // installed claude release (see `builtin_tools_for`). Nothing here wants
     // "a subagent with no built-ins" anyway, so an empty resolution is a bug
     // either way, and failing on it is safe under every reading.
     assert!(
@@ -2063,9 +2071,9 @@ fn acp_runtime(
     sessions: &Path,
     name: &str,
 ) -> AcpRuntime<hive_claude::NeverCompact> {
-    let groups = hive_sh4re::permissions::effective_tool_groups();
+    let perms = crate::swarm_models::permissions_now();
     let permit: PermissionPolicy =
-        Arc::new(move |ask: &PermissionAsk<'_>| acp_permits(ask, &groups));
+        Arc::new(move |ask: &PermissionAsk<'_>| acp_permits(ask, &perms));
     AcpRuntime::new(
         command,
         acp_session_file(sessions, name),
@@ -2079,15 +2087,15 @@ fn acp_runtime(
 ///
 /// - `other`-kind calls to tools of the MCP servers the session was handed;
 /// - the file tools: `read`, `edit`, `search`;
-/// - `fetch` with the `web_tools` group;
-/// - `execute` with the `execution` group, as a claude subagent gets `Bash`
+/// - `fetch` with the `web_tools` permission;
+/// - `execute` with the `execution` permission, as a claude subagent gets `Bash`
 ///   ([`hive_sh4re::permissions::subagent_builtin_tools_for`]).
-fn acp_permits(ask: &PermissionAsk<'_>, groups: &[ToolGroup]) -> bool {
+fn acp_permits(ask: &PermissionAsk<'_>, perms: &[Permission]) -> bool {
     match ask.kind {
         "other" => ask.mcp_server.is_some(),
         "read" | "edit" | "search" => true,
-        "fetch" => groups.contains(&ToolGroup::WebTools),
-        "execute" => groups.contains(&ToolGroup::Execution),
+        "fetch" => perms.contains(&Permission::WebTools),
+        "execute" => perms.contains(&Permission::Execution),
         _ => false,
     }
 }
@@ -2984,15 +2992,13 @@ mod tests {
     /// parent actually licenses rather than against a restatement of it that
     /// could drift.
     ///
-    /// ⚠️ **Scope: this catches a code divergence, not an environment one.**
-    /// Both sides resolve in one process off one `HIVE_TOOL_GROUPS`, so it
-    /// cannot see the two real units disagreeing about that var — which they
-    /// did until `nix/agent-modules/mcp.nix` forwarded it onto this daemon.
-    /// Nothing in a unit test reaches that; it is a deployment property.
+    /// ⚠️ **Scope: this catches a code divergence, not a read one.** Both
+    /// sides resolve off one permission set here; that the parent and this
+    /// daemon read the same key is a deployment property.
     #[test]
     fn a_subagent_gets_no_builtin_its_parent_lacks() {
         let allowed = hive_sh4re::permissions::subagent_builtin_tools_for(
-            &hive_sh4re::permissions::effective_tool_groups(),
+            &crate::swarm_models::permissions_now(),
         );
         let config = build_config("n", None, None, None, None, None);
         for tool in spawned_tools(&config).split(',') {
@@ -5412,8 +5418,8 @@ echo '{"type":"result","subtype":"success","is_error":false}'
             kind,
             mcp_server: None,
         };
-        let none: &[ToolGroup] = &[];
-        let both = &[ToolGroup::WebTools, ToolGroup::Execution];
+        let none: &[Permission] = &[];
+        let both = &[Permission::WebTools, Permission::Execution];
         for kind in ["read", "edit", "search"] {
             assert!(acp_permits(&ask(kind), none), "{kind}");
         }
diff --git a/hive-subagent-mcp/src/swarm_models.rs b/hive-subagent-mcp/src/swarm_models.rs
index e6be9a4b..5b6a74a9 100644
--- a/hive-subagent-mcp/src/swarm_models.rs
+++ b/hive-subagent-mcp/src/swarm_models.rs
@@ -1,11 +1,13 @@
-//! Reads the subagent settings the swarm sets for this agent.
+//! Reads the subagent settings and permissions the swarm sets for this agent.
 //!
 //! swarm-controller keeps the agent's settings under its key in the
 //! `agent-inference` KV bucket. Its `subagent_models`, when set, is the list
 //! a `start` or `continue` naming a `model` is checked against, in place of
 //! `HIVE_AVAILABLE_MODELS` (`crate::session::check_model`). Its
 //! `max_subagents`, when set, caps how many subagents run at once
-//! (`crate::session::State::reserve_under`).
+//! (`crate::session::State::reserve_under`). The agent's permissions, under
+//! its key in `agent-permissions`, decide a new subagent's tools
+//! ([`permissions_now`]).
 //!
 //! **Read on every `start` and `continue`**, never cached, with the one subject the
 //! agent's own queue credential is granted in that bucket
@@ -18,15 +20,35 @@
 //! [`Read::Failed`]: the caller checks against `HIVE_AVAILABLE_MODELS` and
 //! applies no cap.
 
+use std::path::Path;
 #[cfg(test)]
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::{Arc, OnceLock};
 use std::time::Duration;
 
+use hive_sh4re::permissions::Permission;
 use swarm_queue_client::agent_inference::{self, AgentInference, read_own};
+use swarm_queue_client::agent_permissions::{self, HIVE_COPY_PATH, HiveCopy};
 
 use crate::swarm_term::{Target, connect};
 
+/// The last permission set [`Reader::refresh_permissions`] read; `None` until
+/// one succeeds.
+static LAST_PERMISSIONS: std::sync::RwLock<Option<Vec<Permission>>> = std::sync::RwLock::new(None);
+
+/// The permissions this agent holds now, for the subagent being spawned: the
+/// last set read, or what hive-c0re stored for the agent before any read
+/// succeeds ([`HiveCopy::before_read`]).
+#[must_use]
+pub fn permissions_now() -> Vec<Permission> {
+    let last = LAST_PERMISSIONS
+        .read()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .clone();
+    let agent = std::env::var(crate::swarm_term::ENV_AGENT_NAME).unwrap_or_default();
+    last.unwrap_or_else(|| HiveCopy::read_at(Path::new(HIVE_COPY_PATH)).before_read(&agent))
+}
+
 /// How long after a failed connect the task tries again.
 const RETRY_AFTER: Duration = Duration::from_mins(1);
 
@@ -126,6 +148,44 @@ impl Reader {
             }
         }
     }
+
+    /// Read the permissions the swarm grants this agent and keep them for
+    /// [`permissions_now`], judged by [`HiveCopy::after_read`]. A read that
+    /// fails keeps the last value.
+    pub async fn refresh_permissions(&self) {
+        let read = match &self.source {
+            Source::Queue { agent, client } => read_permissions(agent, client).await,
+            #[cfg(test)]
+            Source::Fixed { .. } => None,
+        };
+        if let Some(perms) = read {
+            *LAST_PERMISSIONS
+                .write()
+                .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(perms);
+        }
+    }
+}
+
+async fn read_permissions(
+    agent: &str,
+    client: &OnceLock<async_nats::Client>,
+) -> Option<Vec<Permission>> {
+    let client = client.get()?;
+    swarm_queue_client::ensure_connected(client).ok()?;
+    match tokio::time::timeout(READ_TIMEOUT, agent_permissions::read(client, agent)).await {
+        Ok(Ok(agent_permissions::Read::Current(record))) => {
+            Some(HiveCopy::read_at(Path::new(HIVE_COPY_PATH)).after_read(agent, &record))
+        }
+        Ok(Ok(agent_permissions::Read::NoBucket)) => None,
+        Ok(Err(e)) => {
+            tracing::warn!(error = %e, "subagent permissions: reading this agent's key failed");
+            None
+        }
+        Err(_) => {
+            tracing::warn!("subagent permissions: no answer within {READ_TIMEOUT:?}");
+            None
+        }
+    }
 }
 
 async fn read_queue(agent: &str, client: &OnceLock<async_nats::Client>) -> Read {
diff --git a/hive-subagent-mcp/src/swarm_term.rs b/hive-subagent-mcp/src/swarm_term.rs
index 263ab287..4d92c67f 100644
--- a/hive-subagent-mcp/src/swarm_term.rs
+++ b/hive-subagent-mcp/src/swarm_term.rs
@@ -43,7 +43,7 @@ use tokio::sync::mpsc;
 
 /// Names the agent. The store role, the store path, the queue token and the
 /// subjects are all built from it.
-const ENV_AGENT_NAME: &str = "HIVE_AGENT_NAME";
+pub(crate) const ENV_AGENT_NAME: &str = "HIVE_AGENT_NAME";
 
 /// Where the swarm queue listens, as this container reaches it.
 const ENV_NATS_URL: &str = "HIVE_AGENT_NATS_URL";
diff --git a/nix/agent-modules/agent-service.nix b/nix/agent-modules/agent-service.nix
index 27d803f0..5350766e 100644
--- a/nix/agent-modules/agent-service.nix
+++ b/nix/agent-modules/agent-service.nix
@@ -19,7 +19,7 @@ let
   # Tools opencode must not offer, mirroring claude's built-in allow-list
   # (hive_sh4re::permissions): no built-in shell (shell is `mcp__bash__run`),
   # no nested agents, no in-session todo list, no web search. `webfetch`
-  # asks, and the harness answers per the `web_tools` tool group. Passed as
+  # asks, and the harness answers per the `web_tools` permission. Passed as
   # OPENCODE_PERMISSION because opencode merges that over every config file,
   # including ones the agent can write.
   opencodePermission = {
diff --git a/nix/agent-modules/mcp.nix b/nix/agent-modules/mcp.nix
index 77bbd155..d88831d2 100644
--- a/nix/agent-modules/mcp.nix
+++ b/nix/agent-modules/mcp.nix
@@ -382,17 +382,7 @@ in
         # HIVE_AGENT_SOCKET (agent-service.nix).
         HIVE_AGENT_SOCKET = "/run/hive-agent/${userName}/agent.sock";
         RUST_LOG = "info";
-        # This daemon resolves each subagent's `--tools` from the same
-        # tool groups the harness resolves its own session from, so that a
-        # subagent's built-in tools are its parent agent's and never wider.
-        # The meta renderer writes this var onto the harness unit alone, so
-        # forward it from there rather than re-deriving it: without it the
-        # daemon falls back to the default groups and an agent granted
-        # `web_tools` would spawn subagents that quietly lack web access.
-        # `null` when the agent has no groups declared, which systemd drops
-        # — the same "absent" the harness itself would see.
-        HIVE_TOOL_GROUPS = config.systemd.services.hive-agent.environment.HIVE_TOOL_GROUPS or null;
-        # The harness's runtime selection, forwarded the same way, so an ACP
+        # The harness's runtime selection, forwarded from its unit, so an ACP
         # agent's subagents run on its ACP agent. All five are absent on a
         # claude agent, which the daemon reads as claude.
         HIVE_RUNTIME = config.systemd.services.hive-agent.environment.HIVE_RUNTIME or null;
diff --git a/nix/host-modules/swarm-nats.nix b/nix/host-modules/swarm-nats.nix
index 99806e70..aacc1fac 100644
--- a/nix/host-modules/swarm-nats.nix
+++ b/nix/host-modules/swarm-nats.nix
@@ -831,6 +831,11 @@ in
                 # Its own key of the `agent-inference` KV bucket
                 # (`swarm_queue_client::agent_inference`), on the same terms.
                 "--agent-token-publish-subject ${lib.escapeShellArg "\$\$JS.API.DIRECT.GET.KV_agent-inference.\$\$KV.agent-inference.{agent}"}"
+                # Its own key of the `agent-permissions` KV bucket
+                # (`swarm_queue_client::agent_permissions`), on the same terms:
+                # the harness and the subagent daemon read the tool permissions
+                # it holds.
+                "--agent-token-publish-subject ${lib.escapeShellArg "\$\$JS.API.DIRECT.GET.KV_agent-permissions.\$\$KV.agent-permissions.{agent}"}"
                 "--store-cert-role ${lib.escapeShellArg authCertRole}"
               ];
               # The store identity arrives by `LoadCredential` and is named
diff --git a/nix/module-eval/nats-authelia.nix b/nix/module-eval/nats-authelia.nix
index 45baf363..496badbf 100644
--- a/nix/module-eval/nats-authelia.nix
+++ b/nix/module-eval/nats-authelia.nix
@@ -312,7 +312,7 @@ let
       # The whole per-agent grant, compared as a list rather than by infix: a
       # wider subject added beside these (`$$JS.API.>`, another stream's name)
       # would pass every presence check above.
-      name = "a verified agent's grant is exactly its own subjects, and its JetStream API subjects read its own schedule and inference keys";
+      name = "a verified agent's grant is exactly its own subjects, and its JetStream API subjects read its own schedule, inference and permissions keys";
       ok =
         let
           args = lib.splitString " " (responderOf natsOldPath).serviceConfig.ExecStart;
@@ -332,6 +332,7 @@ let
           "'$$SWARM.term.{agent}.sub.>'"
           "'$$JS.API.DIRECT.GET.KV_agent-schedules.$$KV.agent-schedules.{agent}'"
           "'$$JS.API.DIRECT.GET.KV_agent-inference.$$KV.agent-inference.{agent}'"
+          "'$$JS.API.DIRECT.GET.KV_agent-permissions.$$KV.agent-permissions.{agent}'"
         ];
     }
     {
diff --git a/swarm-controller/Cargo.toml b/swarm-controller/Cargo.toml
index 56e7eefa..b6e04ee8 100644
--- a/swarm-controller/Cargo.toml
+++ b/swarm-controller/Cargo.toml
@@ -66,6 +66,9 @@ sha2.workspace = true
 # `forge/pull_diff.rs` diffs a PR's changed files itself, at a context width
 # the forge's own `.diff` does not offer.
 similar.workspace = true
+# The `Permission` names `/api/agents/{name}/permissions` accepts, the same
+# enum the hive enforces.
+hive-sh4re.workspace = true
 # Validates `POST /api/agents`' `name` before it becomes `agent`/`repo`
 # everywhere downstream — see `create_agent`'s doc comment for why this is
 # defense-in-depth, not the only gate (per an argus review finding).
@@ -102,6 +105,7 @@ swarm-authelia-bridge-sock.workspace = true
 # carries.
 swarm-queue-client = { workspace = true, features = [
   "kv",
+  "agent-permissions",
   "subagent-term",
   "agent-term",
   "schema",
diff --git a/swarm-controller/src/agent_permissions.rs b/swarm-controller/src/agent_permissions.rs
new file mode 100644
index 00000000..ba2d186f
--- /dev/null
+++ b/swarm-controller/src/agent_permissions.rs
@@ -0,0 +1,737 @@
+//! `/api/agents/{name}/permissions` — the permission set the swarm grants one
+//! agent — and the one-shot import of the grants a hive's meta repo held.
+//!
+//! Each agent's permissions are one value under its own key of
+//! `agent-permissions` (`swarm_queue_client::agent_permissions`), which this
+//! daemon alone writes. The agent's harness and subagent daemon apply the tool
+//! permissions at their next turn or start; the hive running the agent
+//! restarts it when `manage_root_agent` changes. An unset field leaves the
+//! agent on the compiled-in default; an empty list grants nothing.
+
+use std::collections::BTreeSet;
+use std::sync::Arc;
+
+use axum::Json;
+use axum::extract::{Path, State};
+use axum::http::StatusCode;
+use futures_util::StreamExt as _;
+use hive_sh4re::permissions::Permission;
+use problem_details::ProblemDetails;
+use serde::{Deserialize, Serialize};
+use swarm_queue_client::agent_permissions::{self, AgentPermissions, Import, ImportReply};
+use utoipa::ToSchema;
+
+use crate::schedules::{live, queue, read_or_default, refused, write, write_revision};
+use crate::wanted::WantedWriter;
+use crate::{AppState, error_problem, wanted_error_status};
+
+/// How many times a losing writer re-reads and re-applies, as in
+/// `wanted::MAX_ATTEMPTS`.
+const MAX_ATTEMPTS: usize = 5;
+
+/// One agent's permissions. A field left out is not set by the swarm, and the
+/// compiled-in default applies; an empty list grants nothing.
+#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct Permissions {
+    /// Permission names, `snake_case`: `messaging`, `meta`, `inbox`,
+    /// `execution`, `web_tools`, `manage_root_agent`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[schema(value_type = Option<Vec<String>>, example = json!(["messaging", "meta", "inbox", "execution"]))]
+    permissions: Option<Vec<Permission>>,
+}
+
+impl Permissions {
+    /// The value to store, or why it is refused.
+    fn into_stored(self) -> Result<AgentPermissions, String> {
+        if let Some(perms) = &self.permissions {
+            unique(perms)?;
+        }
+        Ok(AgentPermissions {
+            permissions: self.permissions,
+        })
+    }
+}
+
+/// Refuse a list that names a permission twice.
+pub(crate) fn unique(perms: &[Permission]) -> Result<(), String> {
+    let mut seen = std::collections::HashSet::new();
+    for perm in perms {
+        if !seen.insert(*perm) {
+            let name: &str = (*perm).into();
+            return Err(format!("permission {name:?} is listed twice"));
+        }
+    }
+    Ok(())
+}
+
+impl From<AgentPermissions> for Permissions {
+    fn from(v: AgentPermissions) -> Self {
+        Self {
+            permissions: v.permissions,
+        }
+    }
+}
+
+fn agent_name(name: &str) -> Result<String, (StatusCode, String)> {
+    hive_types::Ident::parse(name)
+        .map(hive_types::Ident::into_string)
+        .map_err(|reason| (StatusCode::BAD_REQUEST, reason.to_owned()))
+}
+
+fn queue_problem(e: &anyhow::Error) -> ProblemDetails {
+    tracing::warn!(error = %format!("{e:#}"), "agent permissions: queue failure");
+    error_problem(wanted_error_status(e), &format!("{e:#}"))
+}
+
+async fn open_or_create(
+    client: &async_nats::Client,
+) -> Result<async_nats::jetstream::kv::Store, ProblemDetails> {
+    agent_permissions::open_or_create(client)
+        .await
+        .map_err(|e| queue_problem(&anyhow::Error::new(e)))
+}
+
+#[utoipa::path(
+    get,
+    path = "/api/agents/{name}/permissions",
+    params(("name" = String, Path, description = "agent name")),
+    responses(
+        (status = 200, description = "the permissions the swarm sets for the agent; `{}` \
+            when it sets none", body = Permissions),
+        (status = 400, description = "not an identifier (problem+json)", body = String),
+        (status = 503, description = "no swarm queue is configured on this host, or it is \
+            not connected (problem+json)", body = String),
+        (status = 500, description = "the permissions could not be read (problem+json)",
+            body = String),
+    ),
+    tag = "agents"
+)]
+pub(crate) async fn get_agent_permissions(
+    State(state): State<AppState>,
+    Path(name): Path<String>,
+) -> Result<Json<Permissions>, ProblemDetails> {
+    let agent = agent_name(&name).map_err(refused)?;
+    let client = queue(&state).map_err(refused)?;
+    let store = open_or_create(&client).await?;
+    let (current, _, _) = read_or_default::<AgentPermissions>(&store, &agent)
+        .await
+        .map_err(|e| queue_problem(&e))?;
+    Ok(Json(current.into()))
+}
+
+/// Set the permissions the swarm grants one agent.
+///
+/// The value replaces the stored one whole. The hive running the agent reads
+/// it within 30 seconds and restarts the agent, after its current turn, when
+/// `manage_root_agent` changed; the agent applies the rest at its next turn.
+#[utoipa::path(
+    put,
+    path = "/api/agents/{name}/permissions",
+    params(("name" = String, Path, description = "agent name")),
+    request_body = Permissions,
+    responses(
+        (status = 200, description = "the permissions as stored", body = Permissions),
+        (status = 400, description = "not an identifier, not declared on any hive, or a \
+            permission listed twice (problem+json)", body = String),
+        (status = 422, description = "an unknown field or permission name"),
+        (status = 503, description = "no swarm queue is configured on this host, or it is \
+            not connected (problem+json)", body = String),
+        (status = 500, description = "the permissions could not be written (problem+json)",
+            body = String),
+    ),
+    tag = "agents"
+)]
+pub(crate) async fn put_agent_permissions(
+    State(state): State<AppState>,
+    Path(name): Path<String>,
+    Json(req): Json<Permissions>,
+) -> Result<Json<Permissions>, ProblemDetails> {
+    let agent = agent_name(&name).map_err(refused)?;
+    let value = req
+        .into_stored()
+        .map_err(|why| error_problem(StatusCode::BAD_REQUEST, &why))?;
+    let client = queue(&state).map_err(refused)?;
+    if !live(&state).await?.contains(&agent) {
+        return Err(error_problem(
+            StatusCode::BAD_REQUEST,
+            &format!("no hive's wanted state declares an agent {agent:?} that is not destroyed"),
+        ));
+    }
+    let store = open_or_create(&client).await?;
+    for _ in 0..MAX_ATTEMPTS {
+        let (current, revision, undecodable) = read_or_default::<AgentPermissions>(&store, &agent)
+            .await
+            .map_err(|e| queue_problem(&e))?;
+        if (current == value && !undecodable)
+            || write(&store, &agent, &value, revision)
+                .await
+                .map_err(|e| queue_problem(&e))?
+        {
+            tracing::info!(%agent, ?value, "set agent permissions");
+            return Ok(Json(value.into()));
+        }
+    }
+    Err(queue_problem(&anyhow::anyhow!(
+        "gave up writing the permissions of {agent} after {MAX_ATTEMPTS} conflicting writes"
+    )))
+}
+
+#[utoipa::path(
+    delete,
+    path = "/api/agents/{name}/permissions",
+    params(("name" = String, Path, description = "agent name")),
+    responses(
+        (status = 204, description = "cleared; the hive's default applies again"),
+        (status = 400, description = "not an identifier (problem+json)", body = String),
+        (status = 503, description = "no swarm queue is configured on this host, or it is \
+            not connected (problem+json)", body = String),
+        (status = 500, description = "the permissions could not be cleared (problem+json)",
+            body = String),
+    ),
+    tag = "agents"
+)]
+pub(crate) async fn delete_agent_permissions(
+    State(state): State<AppState>,
+    Path(name): Path<String>,
+) -> Result<StatusCode, ProblemDetails> {
+    let agent = agent_name(&name).map_err(refused)?;
+    let client = queue(&state).map_err(refused)?;
+    let store = open_or_create(&client).await?;
+    store
+        .delete(&agent)
+        .await
+        .map_err(|e| queue_problem(&anyhow::Error::new(e)))?;
+    tracing::info!(%agent, "cleared agent permissions");
+    Ok(StatusCode::NO_CONTENT)
+}
+
+/// Delete a destroyed agent's key. A name is free again once its agent is
+/// destroyed, and a create left on the default stores nothing, so a key left
+/// here would hand the next agent of that name this one's grant.
+///
+/// Like the credential revoke it runs beside, a failure is logged and does
+/// not stop the destroy; declaring the agent destroyed again re-runs it.
+pub(crate) async fn clear_on_destroy(state: &AppState, hive: &str, agent: &str) {
+    let cleared = async {
+        let client = queue(state).map_err(|(_, why)| anyhow::anyhow!(why))?;
+        agent_permissions::open_or_create(&client)
+            .await?
+            .delete(agent)
+            .await?;
+        anyhow::Ok(())
+    }
+    .await;
+    match cleared {
+        Ok(()) => tracing::info!(hive, agent, "destroyed agent's permissions cleared"),
+        Err(e) => tracing::error!(
+            hive,
+            agent,
+            error = %format!("{e:#}"),
+            "clearing this agent's permissions FAILED; it was destroyed anyway, so a new \
+             agent of the same name created on the default gets its grant. Declaring the \
+             agent destroyed again re-runs this."
+        ),
+    }
+}
+
+/// Every permission name, and the set an agent the swarm sets nothing for
+/// holds — so a client lists them without a copy of its own.
+#[derive(Debug, Serialize, ToSchema)]
+pub(crate) struct Catalogue {
+    #[schema(value_type = Vec<String>)]
+    all: Vec<Permission>,
+    #[schema(value_type = Vec<String>)]
+    default: Vec<Permission>,
+}
+
+#[utoipa::path(
+    get,
+    path = "/api/permissions",
+    responses((status = 200, description = "every permission name, and the default set",
+        body = Catalogue)),
+    tag = "agents"
+)]
+pub(crate) async fn get_permission_catalogue() -> Json<Catalogue> {
+    Json(Catalogue {
+        all: Permission::ALL.to_vec(),
+        default: Permission::DEFAULT.to_vec(),
+    })
+}
+
+/// The value `POST /api/agents` stores for `perms`, or why it is refused.
+/// The agent is not declared on its hive yet, so the "declared by a hive"
+/// check of [`put_agent_permissions`] does not apply.
+pub(crate) fn at_create(perms: Vec<Permission>) -> Result<AgentPermissions, String> {
+    unique(&perms)?;
+    Ok(AgentPermissions {
+        permissions: Some(perms),
+    })
+}
+
+/// What [`store`] replaced, for [`restore`]; `None` when it wrote nothing.
+pub(crate) type Replaced = Option<crate::schedules::Replaced<AgentPermissions>>;
+
+/// Replace `agent`'s stored permissions with `value`.
+pub(crate) async fn store(
+    client: &async_nats::Client,
+    agent: &str,
+    value: &AgentPermissions,
+) -> Result<Replaced, ProblemDetails> {
+    let store = open_or_create(client).await?;
+    for _ in 0..MAX_ATTEMPTS {
+        let (current, revision, undecodable) = read_or_default::<AgentPermissions>(&store, agent)
+            .await
+            .map_err(|e| queue_problem(&e))?;
+        if current == *value && !undecodable {
+            tracing::info!(%agent, ?value, "set agent permissions at create");
+            return Ok(None);
+        }
+        // A deleted key reads as present at its marker's revision, so ask
+        // whether it holds a value before keeping one to put back.
+        let held = store
+            .get(agent)
+            .await
+            .map_err(|e| queue_problem(&anyhow::Error::new(e)))?
+            .is_some();
+        if let Some(written) = write_revision(&store, agent, value, revision)
+            .await
+            .map_err(|e| queue_problem(&e))?
+        {
+            tracing::info!(%agent, ?value, "set agent permissions at create");
+            return Ok(Some(crate::schedules::Replaced::new(
+                held.then_some(current),
+                written,
+            )));
+        }
+    }
+    Err(queue_problem(&anyhow::anyhow!(
+        "gave up writing the permissions of {agent} after {MAX_ATTEMPTS} conflicting writes"
+    )))
+}
+
+/// Undo what [`store`] did, unless another write has landed since. Best
+/// effort: a failure is logged, since the caller is already on its way to an
+/// error of its own.
+pub(crate) async fn restore(client: &async_nats::Client, agent: &str, replaced: Replaced) {
+    let Some(replaced) = replaced else { return };
+    let undone = match open_or_create(client).await {
+        Ok(store) => replaced.undo(&store, agent).await,
+        Err(e) => Err(anyhow::anyhow!("{e:?}")),
+    };
+    match undone {
+        Ok(true) => {}
+        Ok(false) => {
+            tracing::info!(%agent, "left the agent's permissions: another write landed since");
+        }
+        Err(e) => {
+            tracing::warn!(%agent, error = %format!("{e:#}"), "could not put back the agent's permissions");
+        }
+    }
+}
+
+/// Create the bucket as soon as the queue is connected, then answer every
+/// hive's import. Creating it first means a hive that finds no bucket knows
+/// the queue is not serving it, rather than that nothing is set.
+pub(crate) fn spawn(client: async_nats::Client, wanted: Arc<WantedWriter>, hives: Vec<String>) {
+    tokio::spawn(async move {
+        const RETRY: std::time::Duration = std::time::Duration::from_secs(5);
+        let store = loop {
+            if swarm_queue_client::ensure_connected(&client).is_ok() {
+                match agent_permissions::open_or_create(&client).await {
+                    Ok(store) => break store,
+                    Err(e) => tracing::warn!(
+                        error = swarm_queue_client::chain(&e),
+                        "creating the agent-permissions bucket failed; retrying"
+                    ),
+                }
+            }
+            tokio::time::sleep(RETRY).await;
+        };
+        let subject = agent_permissions::import_subject_wildcard();
+        loop {
+            match client.subscribe(subject.clone()).await {
+                Ok(mut requests) => {
+                    tracing::info!(%subject, "agent permissions: answering imports");
+                    while let Some(msg) = requests.next().await {
+                        let Some(reply) = msg.reply.clone() else {
+                            continue;
+                        };
+                        let answer = answer_import(&store, &wanted, &hives, &msg).await;
+                        let encoded = serde_json::to_vec(&answer).unwrap_or_default();
+                        if let Err(e) = client.publish(reply, encoded.into()).await {
+                            tracing::warn!(error = %e, "agent permissions: answering an import failed");
+                        }
+                    }
+                    tracing::warn!(%subject, "agent permissions: import subscription ended");
+                }
+                Err(e) => {
+                    tracing::warn!(%subject, error = %e, "agent permissions: subscribe failed");
+                }
+            }
+            tokio::time::sleep(RETRY).await;
+        }
+    });
+}
+
+async fn answer_import(
+    store: &async_nats::jetstream::kv::Store,
+    wanted: &WantedWriter,
+    hives: &[String],
+    msg: &async_nats::Message,
+) -> ImportReply {
+    let failed = |error: String| {
+        tracing::warn!(subject = %msg.subject, %error, "agent permissions: import refused");
+        ImportReply::Failed { error }
+    };
+    let Some(hive) = agent_permissions::hive_from_import_subject(&msg.subject) else {
+        return failed(format!("{} is not an import subject", msg.subject));
+    };
+    if !hives.iter().any(|h| h == hive) {
+        return failed(format!("{hive} is not a hive this controller serves"));
+    }
+    let import: Import = match serde_json::from_slice(&msg.payload) {
+        Ok(import) => import,
+        Err(e) => return failed(format!("the import does not decode: {e}")),
+    };
+    let declared = match wanted.view(hive).await {
+        Ok(d) => crate::agent_renewal::live_agents(d.as_slice()),
+        Err(e) => return failed(format!("reading {hive}'s wanted state: {e:#}")),
+    };
+    match import_into(store, &declared, import).await {
+        Ok(reply) => {
+            tracing::info!(%hive, ?reply, "agent permissions: imported a hive's grants");
+            reply
+        }
+        Err(e) => failed(format!("{e:#}")),
+    }
+}
+
+/// Write each agent's imported permissions under its key when it has none,
+/// for the agents in `declared` only.
+async fn import_into(
+    store: &async_nats::jetstream::kv::Store,
+    declared: &BTreeSet<String>,
+    import: Import,
+) -> anyhow::Result<ImportReply> {
+    let (mut written, mut kept, mut skipped) = (Vec::new(), Vec::new(), Vec::new());
+    for (agent, caps) in import.permissions {
+        if !declared.contains(&agent) {
+            skipped.push(agent);
+            continue;
+        }
+        let value = AgentPermissions {
+            permissions: Some(caps),
+        };
+        if write(store, &agent, &value, None).await? {
+            written.push(agent);
+        } else {
+            kept.push(agent);
+        }
+    }
+    Ok(ImportReply::Imported {
+        written,
+        kept,
+        skipped,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        Permissions, delete_agent_permissions, get_agent_permissions, import_into,
+        put_agent_permissions,
+    };
+    use crate::test_nats::TestNats;
+    use axum::extract::{Path, State};
+    use axum::http::StatusCode;
+    use hive_sh4re::permissions::Permission;
+    use swarm_queue_client::agent_permissions::{Import, ImportReply};
+
+    async fn published(client: &async_nats::Client, agent: &str) -> Option<String> {
+        let store = swarm_queue_client::agent_permissions::open_or_create(client)
+            .await
+            .expect("bucket");
+        store
+            .get(agent)
+            .await
+            .expect("read")
+            .map(|v| String::from_utf8(v.to_vec()).expect("utf-8"))
+    }
+
+    fn granted() -> Permissions {
+        Permissions {
+            permissions: Some(vec![Permission::ManageRootAgent]),
+        }
+    }
+
+    async fn put(
+        state: &crate::AppState,
+        agent: &str,
+        value: Permissions,
+    ) -> Result<axum::Json<Permissions>, problem_details::ProblemDetails> {
+        put_agent_permissions(
+            State(state.clone()),
+            Path(agent.to_owned()),
+            axum::Json(value),
+        )
+        .await
+    }
+
+    async fn get(state: &crate::AppState, agent: &str) -> Permissions {
+        get_agent_permissions(State(state.clone()), Path(agent.to_owned()))
+            .await
+            .expect("read")
+            .0
+    }
+
+    /// Through the real handlers: a grant lands as the hive reads it, an empty
+    /// list is stored as an empty list, and `DELETE` takes the key out.
+    #[tokio::test]
+    async fn the_route_writes_what_a_hive_reads_and_delete_clears_it() {
+        let nats = TestNats::start();
+        let client = nats.client().await;
+        let state = crate::agent_limits::tests::declared(&client).await;
+
+        assert_eq!(
+            put(&state, "atlas", granted()).await.expect("set").0,
+            granted()
+        );
+        assert_eq!(
+            published(&client, "atlas").await.as_deref(),
+            Some(r#"{"permissions":["manage_root_agent"]}"#)
+        );
+        assert_eq!(get(&state, "atlas").await, granted());
+
+        let none = Permissions {
+            permissions: Some(Vec::new()),
+        };
+        let _ = put(&state, "atlas", none.clone()).await.expect("set");
+        assert_eq!(
+            published(&client, "atlas").await.as_deref(),
+            Some(r#"{"permissions":[]}"#)
+        );
+
+        assert_eq!(
+            delete_agent_permissions(State(state.clone()), Path("atlas".to_owned())).await,
+            Ok(StatusCode::NO_CONTENT)
+        );
+        assert_eq!(published(&client, "atlas").await, None);
+        assert_eq!(get(&state, "atlas").await, Permissions::default());
+    }
+
+    /// A name no hive declares, or a name that is not an identifier, is a 400
+    /// and writes nothing.
+    #[tokio::test]
+    async fn an_undeclared_or_malformed_agent_is_a_400() {
+        let nats = TestNats::start();
+        let client = nats.client().await;
+        let state = crate::agent_limits::tests::declared(&client).await;
+
+        for agent in ["iris", "Not_An_Ident"] {
+            let problem = put(&state, agent, granted()).await.expect_err("refused");
+            assert_eq!(problem.status, Some(StatusCode::BAD_REQUEST), "{agent}");
+        }
+        assert_eq!(published(&client, "iris").await, None);
+    }
+
+    async fn put_raw(app: &axum::Router, body: &'static str) -> StatusCode {
+        use tower::ServiceExt as _;
+        app.clone()
+            .oneshot(
+                axum::http::Request::put("/api/agents/atlas/permissions")
+                    .header(axum::http::header::CONTENT_TYPE, "application/json")
+                    .body(axum::body::Body::from(body))
+                    .expect("request"),
+            )
+            .await
+            .expect("router answers")
+            .status()
+    }
+
+    /// Behind the real router: an unknown field or permission name is a 422,
+    /// a duplicate is a 400, and none of them changes what is stored.
+    #[tokio::test]
+    async fn a_bad_body_is_refused_and_the_grant_stays() {
+        const GRANTED: &str = r#"{"permissions":["manage_root_agent"]}"#;
+        let nats = TestNats::start();
+        let client = nats.client().await;
+        let state = crate::agent_limits::tests::declared(&client).await;
+        let _ = put(&state, "atlas", granted()).await.expect("set");
+        let app = crate::build_app(state);
+
+        for (body, status) in [
+            (
+                r#"{"permissions":["manage_root_agent"],"tool_groups":["meta"]}"#,
+                StatusCode::UNPROCESSABLE_ENTITY,
+            ),
+            (r#"{"permisions":[]}"#, StatusCode::UNPROCESSABLE_ENTITY),
+            (
+                r#"{"permissions":["lifecycle"]}"#,
+                StatusCode::UNPROCESSABLE_ENTITY,
+            ),
+            (
+                r#"{"permissions":["fly_to_the_moon"]}"#,
+                StatusCode::UNPROCESSABLE_ENTITY,
+            ),
+            (
+                r#"{"permissions":["manage_root_agent","manage_root_agent"]}"#,
+                StatusCode::BAD_REQUEST,
+            ),
+        ] {
+            assert_eq!(put_raw(&app, body).await, status, "{body}");
+            assert_eq!(
+                published(&client, "atlas").await.as_deref(),
+                Some(GRANTED),
+                "{body}"
+            );
+        }
+        // Control: the same router and request do reach the bucket.
+        assert_eq!(put_raw(&app, "{}").await, StatusCode::OK);
+        assert_eq!(published(&client, "atlas").await.as_deref(), Some("{}"));
+    }
+
+    /// The import writes a key only where there is none, and only for the
+    /// agents the sending hive declares.
+    #[tokio::test]
+    async fn an_import_writes_only_missing_keys_of_the_hives_own_agents() {
+        let nats = TestNats::start();
+        let client = nats.client().await;
+        let store = swarm_queue_client::agent_permissions::open_or_create(&client)
+            .await
+            .expect("bucket");
+        store
+            .put("atlas", br#"{"permissions":[]}"#.to_vec().into())
+            .await
+            .expect("seed");
+        let declared = ["atlas".to_owned(), "ruth".to_owned()].into();
+        let import = Import {
+            permissions: [
+                ("atlas".to_owned(), vec![Permission::ManageRootAgent]),
+                ("ruth".to_owned(), vec![Permission::ManageRootAgent]),
+                ("iris".to_owned(), vec![Permission::ManageRootAgent]),
+            ]
+            .into(),
+        };
+
+        let reply = import_into(&store, &declared, import)
+            .await
+            .expect("imported");
+        assert_eq!(
+            reply,
+            ImportReply::Imported {
+                written: vec!["ruth".to_owned()],
+                kept: vec!["atlas".to_owned()],
+                skipped: vec!["iris".to_owned()],
+            }
+        );
+        assert_eq!(
+            published(&client, "atlas").await.as_deref(),
+            Some(r#"{"permissions":[]}"#)
+        );
+        assert_eq!(
+            published(&client, "ruth").await.as_deref(),
+            Some(r#"{"permissions":["manage_root_agent"]}"#)
+        );
+        assert_eq!(published(&client, "iris").await, None);
+    }
+
+    /// `POST /api/agents` with `permissions` stores them under the new agent's
+    /// key in the same call; a list naming one twice is refused before
+    /// anything is stored or queued.
+    #[tokio::test]
+    async fn create_writes_the_permissions_it_is_given() {
+        let nats = TestNats::start();
+        let client = nats.client().await;
+        let state = crate::agent_limits::tests::declared(&client).await;
+        let create = |name: &str, permissions| {
+            crate::create_agent(
+                State(state.clone()),
+                axum::Json(crate::CreateAgentRequest {
+                    name: name.to_owned(),
+                    hive: "pr1ma".to_owned(),
+                    limits: None,
+                    inference: None,
+                    permissions,
+                }),
+            )
+        };
+
+        let problem = create(
+            "iris",
+            Some(vec![Permission::Messaging, Permission::Messaging]),
+        )
+        .await
+        .expect_err("a duplicate is refused");
+        assert_eq!(problem.status, Some(StatusCode::BAD_REQUEST), "{problem:?}");
+        assert_eq!(published(&client, "iris").await, None);
+        let queued = state
+            .jobq
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .graph()
+            .nodes()
+            .count();
+        assert_eq!(queued, 0, "nothing is queued for a refused create");
+
+        let _ = create("iris", Some(vec![Permission::Messaging]))
+            .await
+            .expect("created");
+        assert_eq!(
+            published(&client, "iris").await.as_deref(),
+            Some(r#"{"permissions":["messaging"]}"#)
+        );
+
+        // Control: no `permissions` writes no key, so the default applies.
+        let _ = create("damocles", None).await.expect("created");
+        assert_eq!(published(&client, "damocles").await, None);
+    }
+
+    /// Destroying an agent deletes its key, so a new agent of the same name
+    /// created on the default gets the default, not the old grant.
+    #[tokio::test]
+    async fn a_recreated_agent_does_not_inherit_the_destroyed_ones_grant() {
+        let nats = TestNats::start();
+        let client = nats.client().await;
+        let state = crate::agent_limits::tests::declared(&client).await;
+        let _ = put(&state, "atlas", granted()).await.expect("set");
+
+        let _ = crate::set_agent_state(
+            State(state.clone()),
+            Path(("pr1ma".to_owned(), "atlas".to_owned())),
+            axum::Json(crate::SetAgentStateRequest {
+                state: swarm_queue_client::wanted::AgentState::Destroyed,
+            }),
+        )
+        .await
+        .expect("destroyed");
+        let _ = crate::create_agent(
+            State(state.clone()),
+            axum::Json(crate::CreateAgentRequest {
+                name: "atlas".to_owned(),
+                hive: "pr1ma".to_owned(),
+                limits: None,
+                inference: None,
+                permissions: None,
+            }),
+        )
+        .await
+        .expect("recreated");
+
+        assert_eq!(published(&client, "atlas").await, None);
+        assert_eq!(get(&state, "atlas").await, Permissions::default());
+    }
+
+    #[tokio::test]
+    async fn the_catalogue_lists_every_permission_and_the_default() {
+        let json = serde_json::to_value(super::get_permission_catalogue().await.0).unwrap();
+        assert_eq!(
+            json["all"].as_array().map(Vec::len),
+            Some(Permission::ALL.len())
+        );
+        assert_eq!(
+            json["default"],
+            serde_json::json!(["messaging", "meta", "inbox", "execution"])
+        );
+    }
+}
diff --git a/swarm-controller/src/main.rs b/swarm-controller/src/main.rs
index dd30e4db..a3fa16d2 100644
--- a/swarm-controller/src/main.rs
+++ b/swarm-controller/src/main.rs
@@ -47,6 +47,7 @@ mod agent_identity;
 mod agent_input;
 mod agent_limits;
 mod agent_login;
+mod agent_permissions;
 mod agent_renewal;
 mod agent_state_stream;
 mod agent_status;
@@ -1409,11 +1410,12 @@ async fn set_agent_state(
 
     // After the declaration and never before it: the write above is the
     // destroy order, and until it lands the agent is not being torn down, so
-    // its credential has to keep working. Sequenced rather than spawned so
-    // the revocation attempt is finished — and its outcome logged — by the
-    // time the operator's call returns.
+    // its credential and permissions have to keep working. Sequenced rather
+    // than spawned so both attempts are finished — and their outcomes
+    // logged — by the time the operator's call returns.
     if revokes_queue_credential(req.state) {
         revoke_or_complain(&hive, &agent).await;
+        agent_permissions::clear_on_destroy(&state, &hive, &agent).await;
     }
     Ok(Json(render(&declaration)))
 }
@@ -1741,6 +1743,11 @@ struct CreateAgentRequest {
     /// /api/agents/{name}/inference` takes them. Absent as `limits`.
     #[serde(default)]
     inference: Option<inference::InferenceSettings>,
+    /// The agent's permissions, stored before the job is queued. Left out, the
+    /// agent holds the default set.
+    #[serde(default)]
+    #[schema(value_type = Option<Vec<String>>)]
+    permissions: Option<Vec<hive_sh4re::permissions::Permission>>,
 }
 
 /// Where the queued job landed — a caller polls `/api/jobq/graph` (or
@@ -1794,10 +1801,10 @@ struct CreateAgentResponse {
     request_body = CreateAgentRequest,
     responses(
         (status = 200, description = "job chain queued", body = CreateAgentResponse),
-        (status = 400, description = "`name` or `hive` is not a valid identifier, `name` is new and reserved or refused by the forge, `hive` is not in this swarm, or `limits` or `inference` holds a value the matching `PUT` refuses (problem+json)", body = String),
+        (status = 400, description = "`name` or `hive` is not a valid identifier, `name` is new and reserved or refused by the forge, `hive` is not in this swarm, `limits` or `inference` holds a value the matching `PUT` refuses, or a permission is listed twice (problem+json)", body = String),
         (status = 409, description = "the swarm has already placed `name` on a different hive (problem+json)", body = String),
-        (status = 422, description = "an unknown field in the body, in `limits`, or in `inference`, or an `effort` that is not one of the five levels"),
-        (status = 503, description = "the swarm queue is not connected, so whether `name` is placed on another hive is unknown, or `limits` or `inference` is set and cannot be stored (problem+json)", body = String),
+        (status = 422, description = "an unknown field in the body, in `limits`, or in `inference`, an `effort` that is not one of the five levels, or a `permissions` entry that is not a permission name"),
+        (status = 503, description = "the swarm queue is not connected, so whether `name` is placed on another hive is unknown, or `limits`, `inference` or `permissions` is set and cannot be stored (problem+json)", body = String),
         (status = 500, description = "the job chain could not be queued, or another hive's wanted state could not be read (problem+json)", body = String),
     ),
     tag = "agents"
@@ -1812,15 +1819,7 @@ async fn create_agent(
 
     // Settings are checked before anything is created, so a bad value stops
     // the request rather than leaving an agent without them.
-    let limits = req
-        .limits
-        .map(agent_limits::Caps::into_stored)
-        .transpose()
-        .map_err(|why| error_problem(axum::http::StatusCode::BAD_REQUEST, &why))?;
-    let inference = req
-        .inference
-        .map(inference::InferenceSettings::into_stored)
-        .transpose()
+    let settings = CreateSettings::parse(req.limits, req.inference, req.permissions)
         .map_err(|why| error_problem(axum::http::StatusCode::BAD_REQUEST, &why))?;
 
     // Two checks, and the second is the one that makes the field worth
@@ -1884,7 +1883,7 @@ async fn create_agent(
     }
     // Checked after the roster, so a mistyped hive stays a 400 while the queue
     // is down.
-    let settings_queue = if limits.is_some() || inference.is_some() {
+    let settings_queue = if settings.any() {
         Some(schedules::queue(&state).map_err(schedules::refused)?)
     } else {
         None
@@ -1915,7 +1914,14 @@ async fn create_agent(
     // settings behind for the name.
     let stored = match &settings_queue {
         Some(client) => {
-            StoredSettings::store(client, &agent, limits.as_ref(), inference.as_ref()).await?
+            StoredSettings::store(
+                client,
+                &agent,
+                settings.limits.as_ref(),
+                settings.inference.as_ref(),
+                settings.permissions.as_ref(),
+            )
+            .await?
         }
         None => StoredSettings::default(),
     };
@@ -1947,27 +1953,67 @@ async fn create_agent(
     }))
 }
 
+/// The settings a `POST /api/agents` body gives, as they are stored.
+struct CreateSettings {
+    limits: Option<swarm_queue_client::agent_limits::AgentCaps>,
+    inference: Option<swarm_queue_client::agent_inference::AgentInference>,
+    permissions: Option<swarm_queue_client::agent_permissions::AgentPermissions>,
+}
+
+impl CreateSettings {
+    /// Each setting given, or why its `PUT` would refuse the first bad one.
+    fn parse(
+        limits: Option<agent_limits::Caps>,
+        inference: Option<inference::InferenceSettings>,
+        permissions: Option<Vec<hive_sh4re::permissions::Permission>>,
+    ) -> Result<Self, String> {
+        Ok(Self {
+            limits: limits.map(agent_limits::Caps::into_stored).transpose()?,
+            inference: inference
+                .map(inference::InferenceSettings::into_stored)
+                .transpose()?,
+            permissions: permissions.map(agent_permissions::at_create).transpose()?,
+        })
+    }
+
+    /// Whether any setting is given.
+    fn any(&self) -> bool {
+        self.limits.is_some() || self.inference.is_some() || self.permissions.is_some()
+    }
+}
+
 /// What `create_agent` replaced in the settings stores, to put back if the
 /// creation is refused after the write.
 #[derive(Default)]
 struct StoredSettings {
     limits: agent_limits::Replaced,
     inference: inference::Replaced,
+    permissions: agent_permissions::Replaced,
 }
 
 impl StoredSettings {
-    /// Store whichever of `limits` and `inference` are given. A failure on
-    /// the second puts back the first.
+    /// Store whichever of `limits`, `permissions` and `inference` are given, in
+    /// that order. A failure on one puts back the ones stored before it.
     async fn store(
         client: &async_nats::Client,
         agent: &str,
         limits: Option<&swarm_queue_client::agent_limits::AgentCaps>,
         inference: Option<&swarm_queue_client::agent_inference::AgentInference>,
+        permissions: Option<&swarm_queue_client::agent_permissions::AgentPermissions>,
     ) -> Result<Self, problem_details::ProblemDetails> {
         let mut stored = Self::default();
         if let Some(limits) = limits {
             stored.limits = agent_limits::store(client, agent, limits).await?;
         }
+        if let Some(permissions) = permissions {
+            match agent_permissions::store(client, agent, permissions).await {
+                Ok(replaced) => stored.permissions = replaced,
+                Err(e) => {
+                    stored.roll_back(client, agent).await;
+                    return Err(e);
+                }
+            }
+        }
         if let Some(inference) = inference {
             match inference::store(client, agent, inference).await {
                 Ok(replaced) => stored.inference = replaced,
@@ -1983,6 +2029,7 @@ impl StoredSettings {
     async fn roll_back(self, client: &async_nats::Client, agent: &str) {
         agent_limits::restore(client, agent, self.limits).await;
         inference::restore(client, agent, self.inference).await;
+        agent_permissions::restore(client, agent, self.permissions).await;
     }
 }
 
@@ -2877,11 +2924,22 @@ fn spawn_subagent_streams(status: Option<&Arc<status::StatusReader>>, hives: &[H
 }
 
 /// The per-agent background passes: subagent and terminal streams, and
-/// schedule keys.
+/// schedule keys, and the permissions bucket and its import.
 /// Lifted out of `main` for `clippy::too_many_lines`.
 fn spawn_per_agent_upkeep(status: Option<&Arc<status::StatusReader>>, hives: &[HiveEntry]) {
     spawn_subagent_streams(status, hives);
     spawn_schedule_reconcile(status, hives);
+    spawn_agent_permissions(status, hives);
+}
+
+/// Create the agent-permissions bucket and answer hives' imports when a swarm
+/// queue is wired up. Same shape as [`spawn_subagent_streams`].
+fn spawn_agent_permissions(status: Option<&Arc<status::StatusReader>>, hives: &[HiveEntry]) {
+    let (Some(status), Some(wanted)) = (status, wanted_writer(status)) else {
+        return;
+    };
+    let hives = hives.iter().map(|h| h.name.clone()).collect();
+    agent_permissions::spawn(status.queue_client(), wanted, hives);
 }
 
 /// Start rewriting every agent's schedule key from the definitions when a
@@ -3493,6 +3551,12 @@ fn build_app(state: AppState) -> axum::Router {
             agent_limits::put_agent_limits,
             agent_limits::delete_agent_limits
         ))
+        .routes(routes!(
+            agent_permissions::get_agent_permissions,
+            agent_permissions::put_agent_permissions,
+            agent_permissions::delete_agent_permissions
+        ))
+        .routes(routes!(agent_permissions::get_permission_catalogue))
         .routes(routes!(get_config_prs))
         .routes(routes!(create_agent))
         .routes(routes!(mint_agent_forge_token))
@@ -3754,6 +3818,7 @@ mod tests {
                 hive: "pr1maa".to_owned(),
                 limits: None,
                 inference: None,
+                permissions: None,
             }),
         )
         .await
@@ -3794,6 +3859,7 @@ mod tests {
                 hive: "pr1ma".to_owned(),
                 limits: None,
                 inference: None,
+                permissions: None,
             }),
         )
         .await
@@ -3956,6 +4022,7 @@ mod tests {
                 agent,
                 Some(&caps(r#"{"cpu_quota":"400%"}"#)),
                 Some(&inference),
+                None,
             )
             .await;
             assert!(stored.is_err(), "{agent}: the inference write must fail");
@@ -3974,6 +4041,71 @@ mod tests {
         );
     }
 
+    /// Through the real handler: when the inference store fails after the
+    /// permissions are stored, the creation is refused and the permissions go
+    /// back to what they were, the earlier value or no key. The inference
+    /// bucket refuses any value, as above, and the refusal is that bucket's.
+    #[tokio::test]
+    async fn a_failed_creation_leaves_no_permissions_behind() {
+        let nats = crate::test_nats::TestNats::start();
+        let client = nats.client().await;
+        async_nats::jetstream::new(client.clone())
+            .create_key_value(async_nats::jetstream::kv::Config {
+                bucket: swarm_queue_client::agent_inference::BUCKET.to_owned(),
+                history: 1,
+                max_value_size: 1,
+                ..Default::default()
+            })
+            .await
+            .expect("a bucket that refuses any value");
+        let state = crate::agent_limits::tests::state(&client);
+        let earlier = crate::agent_permissions::at_create(vec![
+            hive_sh4re::permissions::Permission::Messaging,
+        ])
+        .expect("valid");
+        crate::agent_permissions::store(&client, "atlas", &earlier)
+            .await
+            .expect("an earlier grant");
+
+        for agent in ["atlas", "iris"] {
+            let req: super::CreateAgentRequest = serde_json::from_str(&format!(
+                r#"{{"name":"{agent}","hive":"pr1ma","permissions":["web_tools"],
+                    "inference":{{"model":"opus"}}}}"#
+            ))
+            .expect("body parses");
+            let err = super::create_agent(axum::extract::State(state.clone()), axum::Json(req))
+                .await
+                .expect_err("the inference write must fail");
+            assert_eq!(
+                err.status,
+                Some(axum::http::StatusCode::INTERNAL_SERVER_ERROR),
+                "{agent}: {err:?}"
+            );
+            assert!(
+                err.detail
+                    .as_deref()
+                    .is_some_and(|d| d.contains("message size exceeds maximum allowed")),
+                "{agent}: refused by the inference bucket, not an earlier check: {err:?}"
+            );
+        }
+        let bucket = swarm_queue_client::agent_permissions::open_or_create(&client)
+            .await
+            .expect("bucket");
+        let held =
+            |value: Option<bytes::Bytes>| value.map(|v| String::from_utf8_lossy(&v).into_owned());
+        assert_eq!(
+            held(bucket.get("atlas").await.expect("read")).as_deref(),
+            Some(r#"{"permissions":["messaging"]}"#),
+            "the earlier grant comes back"
+        );
+        assert_eq!(
+            held(bucket.get("iris").await.expect("read")),
+            None,
+            "a grant stored for a name with none is removed"
+        );
+        assert_eq!(node_count(&state.jobq), 0, "nothing may be queued");
+    }
+
     /// A valid cap beside an invalid model stores neither and queues nothing,
     /// on a server that could have stored the cap.
     #[tokio::test]
@@ -4027,6 +4159,7 @@ mod tests {
                 hive: hive.to_owned(),
                 limits: None,
                 inference: None,
+                permissions: None,
             }),
         )
         .await
@@ -5149,6 +5282,7 @@ mod tests {
                 hive: "pr1ma".to_owned(),
                 limits: None,
                 inference: None,
+                permissions: None,
             }),
         )
         .await
@@ -5202,6 +5336,7 @@ mod tests {
                 hive: "pr1ma".to_owned(),
                 limits: None,
                 inference: None,
+                permissions: None,
             }),
         )
         .await
@@ -5251,6 +5386,7 @@ mod tests {
                 hive: "pr1ma".to_owned(),
                 limits: None,
                 inference: None,
+                permissions: None,
             }),
         )
         .await
@@ -5308,6 +5444,7 @@ mod tests {
                 hive: "pr1ma".to_owned(),
                 limits: None,
                 inference: None,
+                permissions: None,
             }),
         )
         .await
@@ -5512,6 +5649,7 @@ mod tests {
                 hive: "pr1ma".to_owned(),
                 limits: None,
                 inference: None,
+                permissions: None,
             }),
         )
         .await
diff --git a/swarm-nats-auth/src/policy.rs b/swarm-nats-auth/src/policy.rs
index 94463a40..8c73f618 100644
--- a/swarm-nats-auth/src/policy.rs
+++ b/swarm-nats-auth/src/policy.rs
@@ -229,7 +229,9 @@ impl Policy {
             return Some(Permissions {
                 publish: self.reader_subjects(),
                 subscribe: Some(Self::reader_subscribe(client_id)),
-                responses: None,
+                // The answer to a hive's permissions import. NATS lets it
+                // answer only a message it received, once.
+                responses: Some(swarm_queue_client::agent_permissions::IMPORT_REPLY_DEADLINE),
             });
         }
         if self.review_classifiers.iter().any(|c| c == client_id) {
@@ -307,7 +309,7 @@ impl Policy {
 
     /// What a reader may subscribe to: every agent's terminal, its
     /// subagents' terminals and its turn state, which the controller relays
-    /// to swarm-ui, and its own reply inbox.
+    /// to swarm-ui, every hive's permissions import, and its own reply inbox.
     ///
     /// The three families are the publishers' (`hive-agent`'s `swarm_term`
     /// and `swarm_agent_state`, `swarm_queue_client::subagent_term`), spelled
@@ -318,6 +320,7 @@ impl Policy {
             swarm_queue_client::term_subject_wildcard(),
             swarm_queue_client::subagent_term::subject_wildcard(),
             swarm_queue_client::agent_state_subject_wildcard(),
+            swarm_queue_client::agent_permissions::import_subject_wildcard(),
             Self::inbox(client_id),
         ]
     }
@@ -561,6 +564,17 @@ impl Policy {
             "$JS.API.DIRECT.GET.{}.>",
             swarm_queue_client::agent_limits::STREAM
         ));
+        // The permissions the swarm grants those agents
+        // (`swarm_queue_client::agent_permissions`), read the same way and
+        // every key for the same reason.
+        subjects.push(format!(
+            "$JS.API.DIRECT.GET.{}.>",
+            swarm_queue_client::agent_permissions::STREAM
+        ));
+        // The one-shot import of the grants this hive's meta repo held, sent
+        // as a request on this hive's own subject: the controller takes the
+        // hive from the subject, so one hive cannot import for another.
+        subjects.push(swarm_queue_client::agent_permissions::import_subject(hive));
         subjects.extend(
             self.extra_hive_subjects
                 .iter()
@@ -837,6 +851,76 @@ mod tests {
         }
     }
 
+    /// A hive reads any agent's permissions and can change none of them; an
+    /// agent, with the template `swarm-nats.nix` passes, reads its own key and
+    /// no other, and writes none.
+    #[test]
+    fn a_hive_reads_every_agents_permissions_and_an_agent_only_its_own() {
+        use swarm_queue_client::agent_permissions::{STREAM, key_subject};
+
+        let direct_get_subject = |agent: &str| {
+            format!("$JS.API.DIRECT.GET.KV_agent-permissions.$KV.agent-permissions.{agent}")
+        };
+        let p = policy()
+            .with_agent_token_subjects(vec![
+                "$JS.API.DIRECT.GET.KV_agent-permissions.$KV.agent-permissions.{agent}".to_owned(),
+            ])
+            .expect("a per-agent template is valid");
+        let hive = p.permissions("hive-alpha").expect("a hive is admitted");
+        let hive_may = |subject: &str| hive.publish.iter().any(|g| covers(g, subject));
+        for agent in ["atlas", "ruth"] {
+            assert!(hive_may(&direct_get_subject(agent)), "cannot read {agent}");
+        }
+        for forbidden in [
+            key_subject("atlas"),
+            format!("$JS.API.STREAM.CREATE.{STREAM}"),
+            format!("$JS.API.STREAM.DELETE.{STREAM}"),
+            format!("$JS.API.STREAM.PURGE.{STREAM}"),
+            format!("$JS.API.CONSUMER.CREATE.{STREAM}"),
+        ] {
+            assert!(!hive_may(&forbidden), "hive alpha may publish {forbidden}");
+        }
+
+        let agent = p.agent_token_permissions("atlas").expect("configured");
+        let agent_may = |subject: &str| agent.publish.iter().any(|g| covers(g, subject));
+        assert!(agent_may(&direct_get_subject("atlas")));
+        for forbidden in [direct_get_subject("ruth"), key_subject("atlas")] {
+            assert!(!agent_may(&forbidden), "atlas may publish {forbidden}");
+        }
+    }
+
+    /// A hive sends its import on its own subject only; the reader hears every
+    /// hive's and may answer, and no other role may send one.
+    #[test]
+    fn a_hive_imports_only_under_its_own_name_and_the_reader_answers() {
+        use swarm_queue_client::agent_permissions::{
+            IMPORT_REPLY_DEADLINE, import_subject, import_subject_wildcard,
+        };
+
+        let p = policy();
+        let hive = p.permissions("hive-alpha").expect("a hive is admitted");
+        let hive_may = |subject: &str| hive.publish.iter().any(|g| covers(g, subject));
+        assert!(hive_may(&import_subject("alpha")));
+        assert!(!hive_may(&import_subject("beta")));
+
+        let reader = p.permissions("swarm-controller").expect("the reader");
+        assert!(
+            reader
+                .subscribe
+                .as_ref()
+                .expect("scoped")
+                .contains(&import_subject_wildcard())
+        );
+        assert_eq!(reader.responses, Some(IMPORT_REPLY_DEADLINE));
+        assert!(
+            !reader
+                .publish
+                .iter()
+                .any(|g| covers(g, &import_subject("alpha"))),
+            "the reader may send an import as a hive"
+        );
+    }
+
     #[test]
     fn an_extra_subject_without_the_placeholder_is_refused() {
         // 🩸 The option exists to put a second stream inside ONE hive's
@@ -1356,7 +1440,6 @@ mod tests {
             .expect("a per-agent template is valid");
         let reader = p.permissions("swarm-controller").expect("the reader");
         assert!(reader.publish.iter().any(|g| covers(g, SUBJECT)));
-        assert_eq!(reader.responses, None);
         for (who, grant) in [
             ("a hive", p.permissions("hive-alpha").expect("a hive")),
             (
diff --git a/swarm-queue-client/Cargo.toml b/swarm-queue-client/Cargo.toml
index 0fb0389f..ed2f85b8 100644
--- a/swarm-queue-client/Cargo.toml
+++ b/swarm-queue-client/Cargo.toml
@@ -50,6 +50,11 @@ schema = ["dep:utoipa"]
 # `agent_limits::read`, for hive-c0re, which reads the key of each agent it
 # runs the same way. Explicit for the same reason as `notices`.
 agent-limits = ["async-nats/jetstream"]
+# `agent_permissions::AgentPermissions` and `read`, for hive-c0re, the agent
+# harness, the subagent daemon and swarm-controller. Pulls `hive-sh4re` for the
+# `Permission` names, so the crates that only need the bucket name do not link
+# it.
+agent-permissions = ["dep:hive-sh4re", "async-nats/jetstream"]
 
 [dependencies]
 # Bare (no `kv`/`jetstream`) unless a consumer opts into the `kv` feature
@@ -58,6 +63,7 @@ async-nats.workspace = true
 # `Shared`, so every caller refused while a secret re-read runs waits on that
 # one read (`stored_secret`).
 futures-util.workspace = true
+hive-sh4re = { workspace = true, optional = true }
 # `blocking` on top of the workspace default (`form`/`json`/`rustls`) —
 # `mint_token_for_blocking` needs `reqwest::blocking::Client` for a caller
 # with no tokio reactor to `.await` an async request on (an OTLP exporter's
diff --git a/swarm-queue-client/src/agent_permissions.rs b/swarm-queue-client/src/agent_permissions.rs
new file mode 100644
index 00000000..9dd80ca8
--- /dev/null
+++ b/swarm-queue-client/src/agent_permissions.rs
@@ -0,0 +1,346 @@
+//! The per-agent permissions KV bucket: one key per agent, holding the
+//! [`hive_sh4re::permissions::Permission`] set the swarm grants it.
+//!
+//! **swarm-controller is the only writer**, and creates the bucket when it
+//! starts. A missing key or an unset `permissions` field leaves the agent on
+//! the compiled-in default (`Permission::default_for`); an empty list grants
+//! nothing.
+//!
+//! **Two readers, each enforcing its own part.** The hive running the agent
+//! applies `manage_root_agent` as bind mounts at container start; its grant
+//! covers every key of this bucket, read-only, for the reason
+//! [`crate::agent_limits`] gives. The agent itself (its harness and subagent
+//! daemon) applies the tool permissions; its grant covers only its own key.
+//! Both read with one `DIRECT.GET` on the agent's key
+//! ([`crate::agent_permissions::key_subject`]).
+//!
+//! Keyed by the agent alone, like [`crate::agent_limits`]: an agent can move
+//! between hives, and its permissions go with it.
+//!
+//! Also carries the one-shot import a hive sends of the grants its meta repo
+//! held ([`crate::agent_permissions::import_subject`]), answered by the
+//! controller.
+
+/// The KV bucket permissions are published into, keyed by agent name.
+pub const BUCKET: &str = "agent-permissions";
+
+/// The stream backing [`BUCKET`]. `create_key_value` prefixes `KV_`.
+pub const STREAM: &str = "KV_agent-permissions";
+
+/// The subject `agent`'s entry is stored under.
+#[must_use]
+pub fn key_subject(agent: &str) -> String {
+    format!("$KV.{BUCKET}.{agent}")
+}
+
+const IMPORT_SUBJECT_PREFIX: &str = "$SWARM.permissions-import";
+
+/// The subject `hive` sends its import on. One per hive, so the hive's grant
+/// names only its own, and the controller takes the hive from the subject
+/// rather than from the payload.
+#[must_use]
+pub fn import_subject(hive: &str) -> String {
+    format!("{IMPORT_SUBJECT_PREFIX}.{hive}")
+}
+
+/// Every [`import_subject`] at once, for the controller's subscription.
+#[must_use]
+pub fn import_subject_wildcard() -> String {
+    import_subject("*")
+}
+
+/// The hive an [`import_subject`] names, or `None` for any other subject.
+#[must_use]
+pub fn hive_from_import_subject(subject: &str) -> Option<&str> {
+    let hive = subject
+        .strip_prefix(IMPORT_SUBJECT_PREFIX)?
+        .strip_prefix('.')?;
+    (!hive.is_empty() && !hive.contains('.')).then_some(hive)
+}
+
+/// How long a hive waits for the controller's answer to an import, and the
+/// queue lets the controller answer.
+pub const IMPORT_REPLY_DEADLINE: std::time::Duration = std::time::Duration::from_secs(30);
+
+/// One agent's permissions: the value under `BUCKET`/`<agent>`. `None` is
+/// "not set by the swarm", which a hive reads as its default.
+///
+/// No `deny_unknown_fields`: a field a newer controller adds must not cost an
+/// older hive the fields it knows.
+#[cfg(feature = "agent-permissions")]
+#[derive(Debug, Clone, Default, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct AgentPermissions {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub permissions: Option<Vec<hive_sh4re::permissions::Permission>>,
+}
+
+/// What a hive sends once: the permissions its meta repo held, by agent.
+#[cfg(feature = "agent-permissions")]
+#[derive(Debug, Clone, Default, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct Import {
+    pub permissions: std::collections::BTreeMap<String, Vec<hive_sh4re::permissions::Permission>>,
+}
+
+/// The controller's answer to an [`Import`].
+#[cfg(feature = "agent-permissions")]
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "state", rename_all = "kebab-case")]
+pub enum ImportReply {
+    /// Every agent was handled. `written` had no key and got the hive's value;
+    /// `kept` already had a key, which was left alone; `skipped` is not an
+    /// agent the sending hive's wanted state declares.
+    Imported {
+        written: Vec<String>,
+        kept: Vec<String>,
+        skipped: Vec<String>,
+    },
+    /// Nothing is known to be written; the hive sends again later.
+    Failed { error: String },
+}
+
+/// Open the permissions bucket, creating it if nothing has yet.
+///
+/// **Controller-side only.** `history: 1`: a hive wants the current value.
+#[cfg(feature = "kv")]
+pub async fn open_or_create(
+    client: &async_nats::Client,
+) -> Result<async_nats::jetstream::kv::Store, crate::Error> {
+    let js = async_nats::jetstream::new(client.clone());
+    crate::kv::open_or_create(
+        &js,
+        BUCKET,
+        "agent-permissions",
+        "Permissions the swarm controller sets for each agent".to_owned(),
+    )
+    .await
+}
+
+/// What reading one agent's key found.
+#[cfg(feature = "agent-permissions")]
+#[derive(Debug)]
+pub enum Read {
+    /// The bucket answered; an absent or deleted key has every field unset.
+    Current(AgentPermissions),
+    /// Nothing answers for the bucket's stream. Not an unset value: it says
+    /// nothing about the agent's permissions.
+    NoBucket,
+}
+
+/// The file hive-c0re writes an agent's [`HiveCopy`] to in that agent's
+/// runtime dir.
+#[cfg(feature = "agent-permissions")]
+pub const HIVE_COPY_FILE: &str = "swarm-permissions.json";
+
+/// Where the agent's own processes read [`HIVE_COPY_FILE`]: the runtime dir
+/// is mounted at `/run/hive` in the container.
+#[cfg(feature = "agent-permissions")]
+pub const HIVE_COPY_PATH: &str = "/run/hive/swarm-permissions.json";
+
+/// What hive-c0re holds for one agent: its record as the hive last stored it
+/// (read from this bucket, or taken from the meta repo before the import),
+/// and whether the meta repo's import is still pending. The agent's harness
+/// and subagent daemon hold [`HiveCopy::before_read`] until their own first
+/// read of the key succeeds, and judge every read with
+/// [`HiveCopy::after_read`].
+#[cfg(feature = "agent-permissions")]
+#[derive(Debug, Clone, Default, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct HiveCopy {
+    #[serde(flatten)]
+    pub stored: AgentPermissions,
+    #[serde(default)]
+    pub import_pending: bool,
+}
+
+#[cfg(feature = "agent-permissions")]
+impl HiveCopy {
+    /// The copy at `path`. A missing or unreadable file is the empty copy,
+    /// which holds the default and has no import pending.
+    #[must_use]
+    pub fn read_at(path: &std::path::Path) -> Self {
+        let bytes = match std::fs::read(path) {
+            Ok(bytes) => bytes,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Self::default(),
+            Err(e) => {
+                tracing::warn!(path = %path.display(), error = %e, "permissions: the hive's copy is unreadable");
+                return Self::default();
+            }
+        };
+        serde_json::from_slice(&bytes).unwrap_or_else(|e| {
+            tracing::warn!(path = %path.display(), error = %e, "permissions: the hive's copy does not decode");
+            Self::default()
+        })
+    }
+
+    /// What `agent` holds before any read of its key has succeeded: the
+    /// stored list, or the default when the hive stored none.
+    #[must_use]
+    pub fn before_read(&self, agent: &str) -> Vec<hive_sh4re::permissions::Permission> {
+        self.stored
+            .permissions
+            .clone()
+            .unwrap_or_else(|| hive_sh4re::permissions::Permission::default_for(agent))
+    }
+
+    /// What `agent` holds after reading `read` from its key. An unset key
+    /// while the import is pending may only mean the grant is not imported
+    /// yet, so the stored list stands; otherwise unset is the default.
+    #[must_use]
+    pub fn after_read(
+        &self,
+        agent: &str,
+        read: &AgentPermissions,
+    ) -> Vec<hive_sh4re::permissions::Permission> {
+        match &read.permissions {
+            Some(list) => list.clone(),
+            None if self.import_pending => self.before_read(agent),
+            None => hive_sh4re::permissions::Permission::default_for(agent),
+        }
+    }
+}
+
+/// Read `agent`'s current permissions with one direct get: the one subject
+/// an agent's own grant covers, and one of those a hive's covers.
+///
+/// # Errors
+///
+/// A failed request or an undecodable value. A request the queue refused for
+/// permissions reaches the client as a timeout, not as a refusal.
+#[cfg(feature = "agent-permissions")]
+pub async fn read(
+    client: &async_nats::Client,
+    agent: &str,
+) -> Result<Read, Box<dyn std::error::Error + Send + Sync>> {
+    use async_nats::jetstream::stream::DirectGetErrorKind;
+
+    let js = async_nats::jetstream::new(client.clone());
+    let stream = js.get_stream_no_info(STREAM).await?;
+    let message = match stream.direct_get_last_for_subject(key_subject(agent)).await {
+        Ok(message) => message,
+        Err(e) if matches!(e.kind(), DirectGetErrorKind::NotFound) => {
+            return Ok(Read::Current(AgentPermissions::default()));
+        }
+        Err(e)
+            if matches!(
+                e.kind(),
+                DirectGetErrorKind::ErrorResponse(status, _)
+                    if status == async_nats::StatusCode::NO_RESPONDERS
+            ) =>
+        {
+            return Ok(Read::NoBucket);
+        }
+        Err(e) => return Err(e.into()),
+    };
+    Ok(Read::Current(decode(
+        message
+            .headers
+            .get("KV-Operation")
+            .map(async_nats::HeaderValue::as_str),
+        &message.payload,
+    )?))
+}
+
+/// One stored message as a value: a KV delete or purge is stored as an empty
+/// marker carrying the `KV-Operation` header, and reads as every field unset.
+#[cfg(feature = "agent-permissions")]
+fn decode(operation: Option<&str>, payload: &[u8]) -> serde_json::Result<AgentPermissions> {
+    if matches!(operation, Some("DEL" | "PURGE")) {
+        return Ok(AgentPermissions::default());
+    }
+    serde_json::from_slice(payload)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The names the grants in `swarm-nats-auth` are built from.
+    #[test]
+    fn names_match_the_queue_grant() {
+        assert_eq!(STREAM, format!("KV_{BUCKET}"));
+        assert_eq!(key_subject("iris"), "$KV.agent-permissions.iris");
+        assert_eq!(import_subject("pr1ma"), "$SWARM.permissions-import.pr1ma");
+        assert_eq!(import_subject_wildcard(), "$SWARM.permissions-import.*");
+    }
+
+    #[test]
+    fn the_hive_is_read_back_from_its_import_subject_only() {
+        assert_eq!(
+            hive_from_import_subject(&import_subject("pr1ma")),
+            Some("pr1ma")
+        );
+        for other in [
+            "$SWARM.permissions-import",
+            "$SWARM.permissions-import.",
+            "$SWARM.permissions-import.a.b",
+            "$SWARM.permissions-importx.pr1ma",
+            "$SWARM.deploy.pr1ma",
+        ] {
+            assert_eq!(hive_from_import_subject(other), None, "{other}");
+        }
+    }
+
+    /// Unset is left out on the wire, `{}` is unset, and an empty list stays
+    /// an empty list: "grants nothing" is not "not set".
+    #[cfg(feature = "agent-permissions")]
+    #[test]
+    fn unset_and_empty_are_different_values() {
+        use hive_sh4re::permissions::Permission;
+        assert_eq!(
+            serde_json::to_string(&AgentPermissions::default()).unwrap(),
+            "{}"
+        );
+        let none: AgentPermissions = serde_json::from_str(r#"{"permissions":[]}"#).unwrap();
+        assert_eq!(none.permissions, Some(Vec::new()));
+        let ruth: AgentPermissions =
+            serde_json::from_str(r#"{"permissions":["manage_root_agent"]}"#).unwrap();
+        assert_eq!(ruth.permissions, Some(vec![Permission::ManageRootAgent]));
+    }
+
+    /// Before a read the stored list stands; after one, a set key wins and an
+    /// unset key is the default unless the import is pending.
+    #[cfg(feature = "agent-permissions")]
+    #[test]
+    fn the_hive_copy_stands_until_read_and_while_the_import_is_pending() {
+        use hive_sh4re::permissions::Permission;
+        let record = |json: &str| -> AgentPermissions { serde_json::from_str(json).unwrap() };
+        let copy = |json: &str| -> HiveCopy { serde_json::from_str(json).unwrap() };
+        let web = vec![Permission::WebTools];
+        let default = Permission::DEFAULT.to_vec();
+
+        assert_eq!(
+            copy(r#"{"permissions":["web_tools"]}"#).before_read("atlas"),
+            web
+        );
+        assert_eq!(copy("{}").before_read("atlas"), default);
+
+        let pending = copy(r#"{"permissions":["web_tools"],"import_pending":true}"#);
+        assert_eq!(pending.after_read("atlas", &record("{}")), web);
+        assert_eq!(
+            pending.after_read("atlas", &record(r#"{"permissions":[]}"#)),
+            Vec::new()
+        );
+        let settled = copy(r#"{"permissions":["web_tools"]}"#);
+        assert_eq!(settled.after_read("atlas", &record("{}")), default);
+    }
+
+    /// Fields a newer controller adds must not cost an older hive the ones it
+    /// knows; a deleted key is unset.
+    #[cfg(feature = "agent-permissions")]
+    #[test]
+    fn decoding_tolerates_unknown_fields_and_reads_a_delete_as_unset() {
+        let decoded = decode(
+            None,
+            br#"{"permissions":["manage_root_agent"],"later_field":["meta"]}"#,
+        )
+        .unwrap();
+        assert_eq!(decoded.permissions.map(|c| c.len()), Some(1));
+        assert_eq!(
+            decode(Some("DEL"), b"").unwrap(),
+            AgentPermissions::default()
+        );
+        assert_eq!(
+            decode(Some("PURGE"), b"").unwrap(),
+            AgentPermissions::default()
+        );
+    }
+}
diff --git a/swarm-queue-client/src/lib.rs b/swarm-queue-client/src/lib.rs
index b2b31dc2..a064af7e 100644
--- a/swarm-queue-client/src/lib.rs
+++ b/swarm-queue-client/src/lib.rs
@@ -221,6 +221,12 @@ pub mod agent_inference;
 /// writing needs `kv` and reading needs `agent-limits`.
 pub mod agent_limits;
 
+/// The bucket swarm-controller sets each agent's permissions in — one key
+/// per agent, read by the hive that runs it, plus the one-shot import a hive
+/// sends. The names are unconditional; writing needs `kv` and the stored type
+/// and reading need `agent-permissions`.
+pub mod agent_permissions;
+
 /// The login flag in an agent's turn-state header. No bucket: it travels
 /// on [`agent_state_subject`] only.
 pub mod agent_login;
diff --git a/swarmctl/src/main.rs b/swarmctl/src/main.rs
index 92f802fe..4875734e 100644
--- a/swarmctl/src/main.rs
+++ b/swarmctl/src/main.rs
@@ -29,6 +29,7 @@ mod agent;
 mod forge;
 mod inference;
 mod login;
+mod permissions;
 mod remote;
 mod schedule;
 mod users;
@@ -290,6 +291,45 @@ enum AgentVerb {
         #[command(subcommand)]
         command: InferenceVerb,
     },
+    /// Show or change the permissions the swarm grants an agent.
+    ///
+    /// The agent applies its tool permissions at its next turn; the hive
+    /// running it restarts it, after its current turn, when
+    /// `manage_root_agent` changes. Unset leaves the agent on the default:
+    /// `messaging`, `meta`, `inbox`, `execution`, plus `manage_root_agent`
+    /// for `ruth`.
+    Permissions {
+        #[command(subcommand)]
+        command: PermissionsVerb,
+    },
+}
+
+#[derive(Subcommand)]
+enum PermissionsVerb {
+    /// Show the permissions the swarm grants an agent, or that it sets none.
+    Get(InferenceAgentArgs),
+    /// Replace the permissions the swarm grants an agent.
+    Set(PermissionsSetArgs),
+    /// Clear the agent's permissions, so the default applies again.
+    Clear(InferenceAgentArgs),
+}
+
+#[derive(Args)]
+struct PermissionsSetArgs {
+    /// Agent name. A hive must declare it.
+    agent: String,
+    /// The permissions to grant, comma-separated: any of `messaging`,
+    /// `meta`, `inbox`, `execution`, `web_tools`, `manage_root_agent`.
+    /// `--permissions ''` grants none.
+    #[arg(
+        long,
+        value_name = "PERMISSIONS",
+        value_delimiter = ',',
+        required = true
+    )]
+    permissions: Vec<String>,
+    #[command(flatten)]
+    socket: ControllerSocketArg,
 }
 
 #[derive(Subcommand)]
@@ -602,6 +642,9 @@ fn main() -> Result<()> {
         Verb::Agent {
             command: AgentVerb::Inference { command },
         } => inference(&remote, command),
+        Verb::Agent {
+            command: AgentVerb::Permissions { command },
+        } => permissions(&remote, command),
         // Same socket-resolution reasoning as `Create` above.
         Verb::Forge {
             command: ForgeVerb::MakeAdmin(args),
@@ -671,6 +714,16 @@ fn inference(remote: &RemoteArgs, command: InferenceVerb) -> Result<()> {
     }
 }
 
+fn permissions(remote: &RemoteArgs, command: PermissionsVerb) -> Result<()> {
+    match command {
+        PermissionsVerb::Get(a) => permissions::get(&a.socket.resolve(remote)?, &a.agent),
+        PermissionsVerb::Set(a) => {
+            permissions::set(&a.socket.resolve(remote)?, &a.agent, a.permissions)
+        }
+        PermissionsVerb::Clear(a) => permissions::clear(&a.socket.resolve(remote)?, &a.agent),
+    }
+}
+
 fn schedule(remote: &RemoteArgs, command: ScheduleVerb) -> Result<()> {
     match command {
         ScheduleVerb::Add(a) => schedule::add(
diff --git a/swarmctl/src/permissions.rs b/swarmctl/src/permissions.rs
new file mode 100644
index 00000000..c5973b48
--- /dev/null
+++ b/swarmctl/src/permissions.rs
@@ -0,0 +1,123 @@
+//! `swarmctl agent permissions` — the permissions the swarm grants one
+//! agent, through swarm-controller's `/api/agents/{name}/permissions` routes.
+//!
+//! The agent applies its tool permissions at its next turn; the hive running
+//! it restarts it, after its current turn, when `manage_root_agent` changes.
+//! Unset leaves the agent on the default set; an empty list grants nothing.
+//!
+//! The shape below mirrors the controller's `Permissions`, for the reason
+//! [`crate::agent`]'s module doc gives. Permission names are checked by the
+//! controller, which answers 422 for one it does not know.
+
+use anyhow::{Context as _, Result};
+use serde::{Deserialize, Serialize};
+
+use crate::agent::{parse_ident, send};
+use crate::remote::Target;
+
+/// One agent's permissions; an absent field is not set at swarm level.
+#[derive(Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+struct Permissions {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    permissions: Option<Vec<String>>,
+}
+
+fn runtime() -> Result<tokio::runtime::Runtime> {
+    tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .context("starting a tokio runtime for the controller request")
+}
+
+/// The agent's permissions path. The name is checked first, so it cannot
+/// reshape the URI.
+fn member(agent: &str) -> Result<String> {
+    let agent = parse_ident(agent, "agent name")?;
+    Ok(format!("/api/agents/{agent}/permissions"))
+}
+
+/// Run `swarmctl agent permissions get`.
+pub(crate) fn get(target: &Target, agent: &str) -> Result<()> {
+    let uri = member(agent)?;
+    let stored: Permissions = runtime()?.block_on(send(
+        target,
+        hyper::Method::GET,
+        &uri,
+        None::<&()>,
+        "permissions-get",
+    ))?;
+    print!("{}", render(&stored));
+    Ok(())
+}
+
+/// Run `swarmctl agent permissions set`: store the given permissions, which
+/// replace the agent's record whole.
+pub(crate) fn set(target: &Target, agent: &str, permissions: Vec<String>) -> Result<()> {
+    let uri = member(agent)?;
+    let stored: Permissions = runtime()?.block_on(send(
+        target,
+        hyper::Method::PUT,
+        &uri,
+        Some(&with_permissions(permissions)),
+        "permissions-set",
+    ))?;
+    print!("{}", render(&stored));
+    Ok(())
+}
+
+/// The record granting `permissions`. An empty name, as `--permissions ''`
+/// gives, is dropped, so that spelling grants nothing.
+fn with_permissions(permissions: Vec<String>) -> Permissions {
+    Permissions {
+        permissions: Some(permissions.into_iter().filter(|c| !c.is_empty()).collect()),
+    }
+}
+
+/// Run `swarmctl agent permissions clear`.
+pub(crate) fn clear(target: &Target, agent: &str) -> Result<()> {
+    let uri = member(agent)?;
+    runtime()?.block_on(send::<(), ()>(
+        target,
+        hyper::Method::DELETE,
+        &uri,
+        None,
+        "permissions-clear",
+    ))?;
+    println!("cleared; {agent} goes back to the default");
+    Ok(())
+}
+
+fn render(p: &Permissions) -> String {
+    let caps = match p.permissions.as_deref() {
+        None => "(not set; the default)".to_owned(),
+        Some([]) => "(none)".to_owned(),
+        Some(caps) => caps.join(", "),
+    };
+    format!("permissions: {caps}\n")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn get_tells_unset_from_none() {
+        let unset: Permissions = serde_json::from_str("{}").unwrap();
+        assert_eq!(render(&unset), "permissions: (not set; the default)\n");
+        let none: Permissions = serde_json::from_str(r#"{"permissions":[]}"#).unwrap();
+        assert_eq!(render(&none), "permissions: (none)\n");
+        let ruth: Permissions =
+            serde_json::from_str(r#"{"permissions":["manage_root_agent"]}"#).unwrap();
+        assert_eq!(render(&ruth), "permissions: manage_root_agent\n");
+    }
+
+    /// `--permissions ''` stores an empty list, not one empty name.
+    #[test]
+    fn an_empty_list_flag_grants_nothing() {
+        let set = with_permissions(vec![String::new()]);
+        assert_eq!(
+            serde_json::to_string(&set).unwrap(),
+            r#"{"permissions":[]}"#
+        );
+    }
+}