agent-authority-map

Auditing Claude Code agent permissions involves generating an authority map that parses settings.json, MCP registrations, hooks, and plugin configurations to surface the actual permission surface and identify hidden authority gaps before deployment.

Implicit agent permissions are actions not explicitly allowed or denied but governed by hook-gated settings. Auditing classifies permissions into explicit allow, explicit deny, implicit, and hook-gated categories to enable risk prioritization.

You visualize MCP server and hook permissions by generating a structured authority map that parses MCP registrations and hook configurations, revealing the tools and settings influencing agent actions to produce a shareable risk report.

Yes, you can check governance compliance by inventorying permission sources across settings, MCP registrations, hooks, and installed plugins, which classifies permissions and generates a clear authority map for governance meetings and deployment reviews.

The best way to surface authority gaps during team onboarding is generating an authority map that parses settings and plugin configurations, revealing where the agent takes actions no human explicitly approved to ensure safe deployment.

You should run an agent permission audit after plugin changes whenever new tools or settings are introduced, as modifying plugins can alter the permission surface and create implicit authority gaps that require risk assessment.