consensus-permission-escalation-guard

consensus-permission-escalation-guard is the final safety gate before privilege elevation is applied.

What this skill does

• validates escalation requests against a strict input schema (reject unknown fields)
• evaluates hard-block and rewrite policy flags for IAM risk patterns
• runs persona-weighted voting (or aggregates external votes)
• returns one of: ALLOW | BLOCK | REQUIRE_REWRITE
• writes decision artifacts for replay/audit

Decision policy shape

Hard-block examples:

• wildcard permissions (*, : *, broad owner/admin jumps)
• missing ticket reference when required
• break-glass escalation without incident reference
• separation-of-duties conflicts (e.g., create + approve authority)