Make a cogitate talent's access_tier a resolved, enforced per-run property distinct from the model tier, and gate the tool surface + command policy by it. - cogitate_contract: AccessCapabilities + tier->capability mapping keyed off COGITATE_ACCESS_TIERS (module-load drift guard; named ValueError on unknown tier) - talent: shared _validate_access_tier (default normal, loud reject), wired into both get_talent_configs (discovery) and get_talent (run path) - openhands.run_cogitate: register sol/read tools from the resolved tier's capabilities instead of unconditionally; finalization stays expects_emit_final-driven - cogitate_policy: tier-aware; deny support send-verbs (create/reply/attach/feedback) for normal/system-read, allow for outbound; reason names both tiers; chaining/substitution backstop scoped to support commands - assign tiers: steward=system-read, support+exec=outbound; all others resolve to normal - docs/COGITATE.md reconciled (system-read surface == normal today; outbound auto-submit via --yes window documented as the deferred next lode) This only narrows WHO may submit; the per-send human-approval gate is the next lode. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>