# Permission Model

What agents may and may not do on behalf of Vision Crafters or a visitor.
Last updated: 2026-07-24.

## Levels
- L0 Read only — read the site + these docs, summarize, recommend. ALLOWED.
- L1 Draft only — draft an enquiry message for the user to review. ALLOWED.
- L2 Submit low-risk request — submit the enquiry form on the user's behalf.
  ALLOWED only with explicit user confirmation of the exact content.
- L3 Modify business data — none exposed. NOT AVAILABLE.
- L4 Spend money / confirm appointments / commit — NOT AVAILABLE. Escalate.
- L5 Delete / refund / charge / legal or financial commitment — NOT AVAILABLE.
  Escalate to a human.

## Rules
- Default to L0/L1. Never exceed L2 through the public site.
- L2 requires the user to confirm name, email, company, and message before send.
- No credentials, payment, or account creation exist on the site — never request
  or fabricate them.
- Never impersonate the studio in outbound commitments (pricing, timelines).
- Log any form submission attempt (what, when, on whose behalf).

## Escalation path
Anything above L2 → stop and hand off to a human via the enquiry form
(`#contact`), clearly stating what needs human confirmation.