You add allowed-tools: Bash(git add *) Bash(git commit *) to a skill. You type /commit, and Claude stages and commits without asking. You send one ...
For further actions, you may consider blocking this person and/or reporting abuse
This distinction matters a lot. A one-turn grant is a convenience boundary, not a security model. The operational question is what the skill can do during that turn, how visible those actions are, and what blocks escalation outside the intended scope.
agreed on the frame — a one-turn grant is ergonomics, not containment. inside the turn the visibility story is the transcript: every call is still shown, and tools outside the grant still prompt. the after-the-fact part is thinner — attributing which actions ran under which grant is the piece I haven't found a good answer for.
The attribution gap is real. I would want the transcript to carry a small grant id on every tool call: grant scope, created-at, expires-at, requested-by, and whether the call matched directly or via a broader permission. Otherwise the UI can show the call happened, but the audit cannot answer whether it happened under the authority the human thought they were granting.
Expiry metadata is the piece I keep circling back to: a transcript shows that a call fired, not whether the permission was still inside its granted window when it did — grant-id gives that half something to attach to. Where does the id boundary land in what you're imagining, and does the broader-permission case pull it in either direction?
I would put the grant id on every tool event, not only the transcript summary. The boundary I care about is: this action was proposed under grant X, executed before expiry Y, and used permission set Z. Broader grants make that more important, because the audit needs to distinguish convenience from actual authority.
The transcript is good for visibility, but I would still want a structured grant id on each call. Otherwise the audit has to infer which permission envelope was active after the fact, and that is exactly when convenience boundaries get overstated.