added permission directive

agents.md

@@ -56,6 +56,17 @@ You may **only modify files listed in the approved plan**.
 
 Scope is **strict**.
 
+### Permission Gates (New Directive)
+
+You must ask for explicit confirmation before doing any of the following:
+
+- Running tests/builds/evaluations (e.g. `nix build`, `nix flake check`, `nixos-rebuild`, `home-manager switch`)
+- Creating commits (`git commit`, `git revert`, etc.)
+- Pushing to any remote (`git push`, etc.)
+
+If you already presented a plan, you must still ask again before crossing one of
+these gates.
+
 ---
 
 ## Flake-Contained `configuration.nix`-Style Modules (Host Modules)