RAM Permission Diagnosis and Repair

Execution constraint: When executing aliyun CLI commands directly (not generating commands for the user to copy), always append --user-agent AlibabaCloud-Agent-Skills. Do not add this flag to commands shown to users in Path B output or Path C console guidance.

Overview

When a RAM permission error is detected, run through these steps:

1. Quick Analysis — parse raw error fields (no tool calls), output a brief summary, ask the user to choose analysis depth
2. Deep Analysis — (only if user selects path B) decode if needed, run gap analysis, classify root cause
3. Generate Recommendations — least-privilege authorization plan
4. Execute Repair — present repair options and wait for user to choose

Permission level (L0–L3) is the agent's internal routing state, inferred implicitly from API call results during the flow. It determines diagnostic depth and available repair paths. Never declare or describe the level to the user. See references/diagnose-flow.md for level definitions.

Step 1: Quick Analysis