StrictLLM Persona Permission Hardening (Delivery)

StrictLLM Persona Permission Hardening (Delivery)

1. 01

   Open the Persona Manager and list every persona assigned to the client workspace

   Confirm each persona has a distinct system prompt and an explicitly assigned provider (OpenAI, Anthropic, OpenRouter, or a local Ollama model). A persona left on a default provider is a delivery risk on privacy-sensitive retainers.

2. 02

   Set each persona's tool permissions to Always Ask before the first client session

   StrictLLM gates every tool action through Always Allow, Always Ask, or Always Deny. Start new client personas on Always Ask, then promote individual tools to Always Allow only after the agency has watched the action run correctly at least twice.

3. 03

   Sandbox each local MCP server in its own isolated Podman container

   One container per data source keeps a client's private filesystem or database from being reachable by a persona that only needs a different server. Name containers after the client so audit reviews map cleanly.

4. 04

   Map @mention chains and verify each hop resolves to the intended persona

   Multi-step workflows run by invoking personas via @mentions. Walk the chain end to end in a staging session and confirm no hop silently falls through to a persona with broader tool access.

5. 05

   Validate offline license activation on the delivery machine

   Starter includes a 7-day offline grace period; Pro adds full offline mode. If the client works air-gapped, confirm the Pro tier is active before handover, otherwise the workspace stops after the grace window.

6. 06

   Record the permission matrix in the client runbook

   Log persona name, assigned model, tool list, and permission state for each entry. This is the artifact the agency hands over at retainer review and the first thing to check when a client asks what the AI can touch.

7. 07

   Re-audit permissions at each monthly retainer checkpoint

   Compare the live Persona Manager against the runbook. Any Always Allow entry added mid-month without a runbook update gets reverted to Always Ask until it is documented.