feat(FN-4488): complete Step 7 — docs and changeset

Fusion-Task-Id: FN-4488
Fusion-Task-Lineage: 3fc1ac43-490f-43f2-a27e-4fdceb64d9c4

docs/agents.md

@@ -1402,3 +1402,24 @@ POST /api/agents/:id/ratings
 - [Workflow Steps](./workflow-steps.md)
 - [Settings Reference](./settings-reference.md)
 - [Architecture](./architecture.md)
+
+## Permission Policies
+
+Permanent-agent sensitive actions are gated across five categories:
+- `git_write`
+- `file_write_delete`
+- `command_execution`
+- `network_api`
+- `task_agent_mutation`
+
+Each category can be set to one disposition:
+- `allow`
+- `require-approval`
+- `block`
+
+Precedence:
+1. Per-agent permission policy override (Agent Detail → Settings → Permissions)
+2. Project default permission policy (`defaultAgentPermissionPolicy` in Project Settings → Agent Permissions)
+3. Built-in fallback preset (`unrestricted` / allow-all)
+
+Per-agent rows can inherit project defaults category-by-category.