An agent's real capability is its tool list, and policy is deciding what's on it: allow the core loop, deny the outward tail until first need, gate the irreversible behind a human. These posts cover the whole decision — how to write an allowlist, which tools to deny by default, why per-call permissions beat roles assigned at login, and the honest part most vendors skip: where client-side rules get bypassed and what enforcement outside the agent process looks like.
The Tool Surface Index is the raw material — every tool Claude Code and Codex declare, grouped by blast radius. The incident-by-incident version is the Stop Your Agent From… series.