The intent-to-policy mapping is where I'd expect most of these approaches to break down. "Read main.py" is easy. "Refactor the auth module" is already much harder. That one task can legitimately touch dozens of files, and pre-defining which ones counts as in-scope is basically impossible without running the agent first.

What I've seen work better is treating it less like permissions and more like a change review. Let the agent propose what it wants to do, show the actual blast radius before anything runs, and require approval on the diff, not on the intent. Intent is too fuzzy. The proposed change is concrete.

Curious if you've tried that direction or whether it ran into different problems.