Contextual Risk for Agent Tool Calls: A 4-State Permission Engine Field-Tested Across 10 Frameworks

The four states are a good middle ground, binary allow lists always end up either too loose or blocking real work. The 2,490 deterministic tests are what caught my eye: keeping the risk classification deterministic is what makes it auditable, an LLM judging its own permission would defeat the point. How do you keep the context rules from drifting as you add the 11th and 12th framework adapter?

Field-testing against 83 real agents instead of mocks is the part most permission projects skip, and your stat matches what we see from the supply-chain side: "About 18% of MCP server deployments implement any access scoping." For our August 2026 census we aggregated every published security audit of the agent skill ecosystem, and the five auditors disagree on what unsafe means: one fails 697 listings, another fails zero, so a deterministic engine with explainable decisions is filling a real vacuum: skillselion.com/research/agent-skill-security-cen… (disclosure: I run Skillselion). I see the escalation round-trip is slated for v0.2, so a design question for when it lands: will an expired escalation fall under DD-14's timeout-means-deny, or does the agent loop block waiting? That choice changes how teams size their approval rota.