Add low-trust review containment (#7530)

## Thinking Path

> - Paperclip is a control plane for AI-agent companies, so execution
policy and trust boundaries are part of the product's safety contract.
> - Low-trust review work needs narrower authority than normal
same-company agents because hostile PRs, comments, attachments, and
generated output can carry prompt-injection payloads.
> - The current V1 shape gives trusted workers broad company context,
which is useful for normal execution but too permissive for a reviewer
assigned to hostile content.
> - This branch adds a `low_trust_review` preset, source-trust tagging,
route-level containment, and quarantine handling so low-trust output
does not automatically flow into higher-trust wake context.
> - The branch has been rebased onto current `origin/master`, and the
low-trust migration was renumbered to `0097_low_trust_source_trust.sql`
to avoid collisions with existing `0091` through `0096` migrations.
> - Greptile feedback was addressed by tightening low-trust detection,
preserving project-level trust policy checks, fixing issue-kind
promotion lookup, removing duplicate post-lease isolation assertion,
documenting fail-closed source-trust behavior, bounding ancestry checks,
enforcing runtime issue context for CEOs, awaiting accepted-plan monitor
authorization, and making low-trust issue source-trust tagging atomic.
> - The benefit is a first production slice of deny-by-default review
containment with regression coverage for the main control-plane pivot
surfaces.

Fixes #7531.

## What Changed

- Added shared trust-policy types and validators, plus
database/source-trust fields for issues, comments, documents, and work
products.
- Implemented server enforcement for low-trust issue scope, agent
self-view redaction, secret/plugin/runtime denial paths, promotion
checks, and quarantined continuation/wake context.
- Added focused low-trust regression tests for resolver behavior, source
trust, route authorization, heartbeat preflight ordering, runtime
containment, and quarantine redaction.
- Added board UI affordances for selecting/reviewing the low-trust
preset and surfacing source-trust badges in relevant issue views.
- Added `doc/LOW-TRUST-PRESETS.md`, updated
`doc/SPEC-implementation.md`, and committed the low-trust review
contract plan under `doc/plans/`.
- Rebasing note: the original `0097_low_trust_source_trust.sql`
migration was renamed to `0097_low_trust_source_trust.sql`; the SQL uses
`ADD COLUMN IF NOT EXISTS` so users who already applied the old-numbered
migration are not broken by the renumbered migration.

## Verification

- Rebased branch onto current `origin/master` and force-pushed with
lease to `origin/PAP-10211-low-trust-agent` at head `2719f31e3`.
- Confirmed the PR diff does not include `pnpm-lock.yaml` or
`.github/workflows` changes.
- Resolved upstream UI/comment conflicts by preserving deleted-comment
tombstone behavior and low-trust source-trust badges/metadata.
- Renumbered the low-trust source-trust migration to
`0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT
EXISTS` so users who already applied an old-numbered copy are not
broken.
- `pnpm exec vitest run ui/src/lib/issue-chat-messages.test.ts
server/src/__tests__/heartbeat-workspace-session.test.ts`
- `pnpm exec vitest run server/src/__tests__/source-trust.test.ts
server/src/__tests__/workspace-runtime-service-authz.test.ts
ui/src/lib/trust-policy-ui.test.ts
ui/src/components/TrustPresetSection.test.tsx`
- `pnpm run typecheck:build-gaps`
- `git diff --check`
- GitHub checks pass on head `2719f31e3`: build, typecheck/release
registry, general tests, serialized server suites, e2e, canary, verify,
policy/review, Socket, and Snyk.
- Greptile Review passes with Confidence Score 5/5 and zero unresolved
Greptile review threads.
- No design screenshots/images were added because the task explicitly
says not to add them unless they are specifically part of the work.

## Risks

- Medium risk: this touches shared trust-policy contracts, server
authorization paths, heartbeat context generation, migration metadata,
and UI preset controls.
- Low-trust containment is intentionally deny-by-default; legitimate
future review workflows may need explicit allowlisted exceptions.
- Plugin/runtime/security surfaces are broad, so regression tests cover
the current known routes but future integrations must route through the
same containment layer.
- The PR is ready for review; GitHub checks are green and Greptile is
5/5.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

- OpenAI Codex, GPT-5 coding agent, tool-enabled shell and GitHub CLI
workflow.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] UI changes are covered by focused tests; no screenshots were added
per task instruction not to add design images unless specifically
required
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>

ui/src/api/agents.ts

@@ -1,5 +1,6 @@
 import type {
   Agent,
+  AgentPermissions,
   AgentDetail,
   AgentInstructionsBundle,
   AgentInstructionsFileDetail,
@@ -67,6 +68,8 @@ export interface AgentHireResponse {
 export interface AgentPermissionUpdate {
   canCreateAgents: boolean;
   canAssignTasks: boolean;
+  trustPreset?: AgentPermissions["trustPreset"];
+  authorizationPolicy?: AgentPermissions["authorizationPolicy"];
 }
 
 export interface AgentWakeRequest {

ui/src/components/IssueChatThread.tsx

@@ -119,6 +119,7 @@ import {
 import type {
   IssueCommentMetadata,
   IssueCommentPresentation,
+  SourceTrustMetadata,
 } from "@paperclipai/shared";
 import {
   describeToolInput,
@@ -137,6 +138,7 @@ import { AlertTriangle, ArrowRight, Brain, Check, ChevronDown, ClipboardList, Co
 import { IssueBlockedNotice } from "./IssueBlockedNotice";
 import { IssueAssignedBacklogNotice } from "./IssueAssignedBacklogNotice";
 import { IssueRecoveryActionCard, type RecoveryResolveOutcome } from "./IssueRecoveryActionCard";
+import { SourceTrustBadge } from "./SourceTrustBadge";
 
 interface IssueChatMessageContext {
   feedbackDataSharingPreference: FeedbackDataSharingPreference;
@@ -1283,6 +1285,7 @@ function IssueChatUserMessage({
   const authorName = typeof custom.authorName === "string" ? custom.authorName : null;
   const authorUserId = typeof custom.authorUserId === "string" ? custom.authorUserId : null;
   const queued = custom.queueState === "queued" || custom.clientStatus === "queued";
+  const sourceTrust = isSourceTrustMetadata(custom.sourceTrust) ? custom.sourceTrust : null;
   const followUpRequested = custom.followUpRequested === true;
   const queueReason = typeof custom.queueReason === "string" ? custom.queueReason : null;
   const queueBadgeLabel = queueReason === "hold" ? "\u23f8 Deferred wake" : "Queued";
@@ -1321,6 +1324,7 @@ function IssueChatUserMessage({
     <div className={cn("flex min-w-0 max-w-[85%] flex-col", isCurrentUser && "items-end")}>
       <div className={cn("mb-1 flex items-center gap-2 px-1", isCurrentUser ? "justify-end" : "justify-start")}>
         <span className="text-sm font-medium text-foreground">{resolvedAuthorName}</span>
+        <SourceTrustBadge sourceTrust={sourceTrust} artifactLabel="comment" />
         {followUpRequested ? (
           <Badge variant="outline" className="text-[10px] uppercase tracking-[0.14em]">
             Follow-up
@@ -1509,6 +1513,7 @@ function IssueChatAssistantMessage({
   const agentId = authorAgentId ?? runAgentId;
   const agentIcon = agentId ? agentMap?.get(agentId)?.icon : undefined;
   const commentId = typeof custom.commentId === "string" ? custom.commentId : null;
+  const sourceTrust = isSourceTrustMetadata(custom.sourceTrust) ? custom.sourceTrust : null;
   const notices = Array.isArray(custom.notices)
     ? custom.notices.filter((notice): notice is string => typeof notice === "string" && notice.length > 0)
     : [];
@@ -1571,6 +1576,7 @@ function IssueChatAssistantMessage({
               onClick={() => setFolded((v) => !v)}
             >
               <span className="text-sm font-medium text-foreground">{authorName}</span>
+              <SourceTrustBadge sourceTrust={sourceTrust} artifactLabel="comment" />
               <span className="text-xs text-muted-foreground/60">{chainOfThoughtLabel?.toLowerCase()}</span>
               <span className="ml-auto flex items-center gap-1.5">
                 {message.createdAt ? (
@@ -1584,6 +1590,7 @@ function IssueChatAssistantMessage({
           ) : (
             <div className="mb-1.5 flex items-center gap-2">
               <span className="text-sm font-medium text-foreground">{authorName}</span>
+              <SourceTrustBadge sourceTrust={sourceTrust} artifactLabel="comment" />
               {followUpRequested ? (
                 <Badge variant="outline" className="text-[10px] uppercase tracking-[0.14em]">
                   Follow-up
@@ -2062,6 +2069,15 @@ function isIssueCommentMetadata(value: unknown): value is IssueCommentMetadata {
   return v.version === 1 && Array.isArray(v.sections);
 }
 
+function isSourceTrustMetadata(value: unknown): value is SourceTrustMetadata {
+  if (!value || typeof value !== "object") return false;
+  const v = value as Record<string, unknown>;
+  return v.preset === "low_trust_review" && (
+    v.disposition === "quarantined" ||
+    v.disposition === "promoted"
+  );
+}
+
 function issueStatusIsTerminalDisposition(issueStatus: string | undefined) {
   return issueStatus === "done" || issueStatus === "cancelled";
 }

ui/src/components/IssueDocumentsSection.tsx

@@ -37,6 +37,7 @@ import {
 } from "@/components/ui/dropdown-menu";
 import { Check, ChevronDown, ChevronRight, Copy, Diff, Download, FilePenLine, FileText, Lock, MoreHorizontal, Plus, Trash2, Unlock, X } from "lucide-react";
 import { DocumentDiffModal } from "./DocumentDiffModal";
+import { SourceTrustBadge } from "./SourceTrustBadge";
 
 type DraftState = {
   key: string;
@@ -138,6 +139,7 @@ function toDocumentSummary(document: IssueDocument) {
     lockedAt: document.lockedAt,
     lockedByAgentId: document.lockedByAgentId,
     lockedByUserId: document.lockedByUserId,
+    sourceTrust: document.sourceTrust,
     createdAt: document.createdAt,
     updatedAt: document.updatedAt,
   };
@@ -929,6 +931,7 @@ export function IssueDocumentsSection({
                     <span className="shrink-0 rounded-full border border-border px-2 py-0.5 font-mono text-[10px] uppercase tracking-[0.16em] text-muted-foreground">
                       {doc.key}
                     </span>
+                    <SourceTrustBadge sourceTrust={doc.sourceTrust} artifactLabel="document" />
                     <DropdownMenu
                       open={revisionMenuOpenKey === doc.key}
                       onOpenChange={(open) => setRevisionMenuOpenKey(open ? doc.key : null)}

ui/src/components/NewIssueDialog.tsx

@@ -59,6 +59,7 @@ import {
   ListTree,
   X,
   Eye,
+  ShieldAlert,
   ShieldCheck,
 } from "lucide-react";
 import { cn } from "../lib/utils";
@@ -67,6 +68,7 @@ import { issueStatusText, issueStatusTextDefault, priorityColor, priorityColorDe
 import { MarkdownEditor, type MarkdownEditorRef, type MentionOption } from "./MarkdownEditor";
 import { AgentIcon } from "./AgentIconPicker";
 import { InlineEntitySelector, type InlineEntityOption } from "./InlineEntitySelector";
+import { getTrustPreset } from "../lib/trust-policy-ui";
 
 const DRAFT_KEY = "paperclip:issue-draft";
 const DEBOUNCE_MS = 800;
@@ -1075,6 +1077,7 @@ export function NewIssueDialog() {
   const currentAssignee = selectedAssigneeAgentId
     ? (agents ?? []).find((a) => a.id === selectedAssigneeAgentId)
     : null;
+  const currentAssigneeLowTrust = getTrustPreset(currentAssignee?.permissions) === "low_trust_review";
   const currentProject = orderedProjects.find((project) => project.id === projectId);
   const currentProjectExecutionWorkspacePolicy =
     experimentalSettings?.enableIsolatedWorkspaces === true
@@ -1385,6 +1388,9 @@ export function NewIssueDialog() {
                     <>
                       {assignee ? <AgentIcon icon={assignee.icon} className="h-3.5 w-3.5 shrink-0 text-muted-foreground" /> : null}
                       <span className="truncate">{option.label}</span>
+                      {assignee && getTrustPreset(assignee.permissions) === "low_trust_review" ? (
+                        <ShieldAlert className="ml-auto h-3.5 w-3.5 shrink-0 text-amber-600 dark:text-amber-300" aria-label="Low-trust review agent" />
+                      ) : null}
                     </>
                   );
                 }}
@@ -2030,6 +2036,18 @@ export function NewIssueDialog() {
           </div>
         ) : null}
 
+        {currentAssigneeLowTrust ? (
+          <div
+            data-testid="new-issue-low-trust-assignee-note"
+            className="mx-4 mb-2 flex items-start gap-2 rounded-md border border-amber-300/70 bg-amber-50/90 px-3 py-2 text-xs text-amber-900 dark:border-amber-500/40 dark:bg-amber-500/10 dark:text-amber-100"
+          >
+            <ShieldAlert className="mt-0.5 h-3.5 w-3.5 shrink-0 text-amber-600 dark:text-amber-300" />
+            <span className="leading-snug">
+              Low-trust review agent. It can only act inside its assigned review boundary; issue, project, or run policy defines the concrete scope.
+            </span>
+          </div>
+        ) : null}
+
         {/* Footer */}
         <div className="flex items-center justify-between px-4 py-2.5 border-t border-border shrink-0">
           <Button

ui/src/components/SourceTrustBadge.tsx

@@ -0,0 +1,48 @@
+import type { SourceTrustMetadata } from "@paperclipai/shared";
+import { BadgeCheck, ShieldAlert } from "lucide-react";
+import { Badge } from "@/components/ui/badge";
+import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip";
+import { sourceTrustLabel } from "../lib/trust-policy-ui";
+import { cn } from "../lib/utils";
+
+export function SourceTrustBadge({
+  sourceTrust,
+  artifactLabel = "content",
+  className,
+}: {
+  sourceTrust: SourceTrustMetadata | null | undefined;
+  artifactLabel?: "comment" | "document" | "work product" | "content";
+  className?: string;
+}) {
+  const label = sourceTrustLabel(sourceTrust);
+  if (!label) return null;
+
+  const promoted = sourceTrust?.disposition === "promoted";
+  const tooltip = promoted
+    ? `Promoted from low-trust${sourceTrust.promotedAt ? ` on ${new Date(sourceTrust.promotedAt).toLocaleString()}` : ""}.`
+    : `Authored by a low-trust review agent. Raw ${artifactLabel} is not auto-shared with higher-trust agents.`;
+
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <Badge
+          variant="outline"
+          aria-label={label}
+          className={cn(
+            "inline-flex items-center gap-1 whitespace-nowrap px-1.5 py-0 text-[10px] font-medium tracking-normal",
+            promoted
+              ? "border-border text-muted-foreground"
+              : "border-amber-500/40 text-amber-700 dark:text-amber-100",
+            className,
+          )}
+        >
+          {promoted ? <BadgeCheck className="h-3 w-3" /> : <ShieldAlert className="h-3 w-3" />}
+          {label}
+        </Badge>
+      </TooltipTrigger>
+      <TooltipContent className="max-w-xs text-xs">
+        {tooltip}
+      </TooltipContent>
+    </Tooltip>
+  );
+}

ui/src/components/TrustPresetSection.test.tsx

@@ -0,0 +1,93 @@
+// @vitest-environment jsdom
+import { createRoot, type Root } from "react-dom/client";
+import { flushSync } from "react-dom";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { AgentPermissions } from "@paperclipai/shared";
+import { TrustPresetSection } from "./TrustPresetSection";
+import { TooltipProvider } from "@/components/ui/tooltip";
+
+(globalThis as unknown as { IS_REACT_ACT_ENVIRONMENT: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+let root: Root | null = null;
+let container: HTMLDivElement | null = null;
+
+function renderSection(permissions: Partial<AgentPermissions>) {
+  container = document.createElement("div");
+  document.body.appendChild(container);
+  const onChange = vi.fn();
+  const createdRoot = createRoot(container);
+  root = createdRoot;
+  flushSync(() => {
+    createdRoot.render(
+      <TooltipProvider>
+        <TrustPresetSection
+          permissions={permissions}
+          onChange={onChange}
+          companyId="company-1"
+          projectCandidates={[{ id: "project-1", label: "Paperclip App" }]}
+          issueCandidates={[{ id: "issue-1", label: "PAP-1 · Review PR" }]}
+        />
+      </TooltipProvider>,
+    );
+  });
+  return { onChange, text: () => container?.textContent ?? "" };
+}
+
+afterEach(() => {
+  if (root) {
+    flushSync(() => root?.unmount());
+  }
+  container?.remove();
+  root = null;
+  container = null;
+});
+
+describe("TrustPresetSection", () => {
+  it("hides the CE boundary editor under Standard", () => {
+    const view = renderSection({ canCreateAgents: false, trustPreset: "standard" });
+
+    expect(view.text()).toContain("Trust preset");
+    expect(view.text()).not.toContain("Boundary type");
+    expect(view.text()).not.toContain("Get Paperclip EE.");
+  });
+
+  it("shows a selectable CE boundary editor for low-trust review", () => {
+    const view = renderSection({
+      canCreateAgents: false,
+      trustPreset: "low_trust_review",
+      authorizationPolicy: {
+        trustPreset: "low_trust_review",
+        trustBoundary: {
+          mode: "low_trust_review",
+          companyId: "company-1",
+          projectIds: ["project-1"],
+        },
+      },
+    });
+
+    expect(view.text()).toContain("Containment active");
+    expect(view.text()).toContain("Boundary type");
+    expect(view.text()).toContain("Paperclip App");
+    expect(view.text()).toContain("Get Paperclip EE.");
+    expect(view.text()).not.toContain("Managed by EE/API");
+  });
+
+  it("renders multi-boundary policies as read-only", () => {
+    const view = renderSection({
+      canCreateAgents: false,
+      trustPreset: "low_trust_review",
+      authorizationPolicy: {
+        trustPreset: "low_trust_review",
+        trustBoundary: {
+          mode: "low_trust_review",
+          companyId: "company-1",
+          projectIds: ["project-1", "project-2"],
+        },
+      },
+    });
+
+    expect(view.text()).toContain("Managed by EE/API");
+    expect(view.text()).toContain("2 boundaries");
+    expect(view.text()).not.toContain("Clear boundary");
+  });
+});

ui/src/components/TrustPresetSection.tsx

@@ -0,0 +1,258 @@
+import { useEffect, useMemo, useState } from "react";
+import type { AgentPermissions, TrustPreset } from "@paperclipai/shared";
+import { Lock, ShieldAlert } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Field, CollapsibleSection } from "./agent-config-primitives";
+import {
+  buildPermissionsForTrustPreset,
+  clearSingleLowTrustBoundaryTarget,
+  getLowTrustBoundary,
+  getSingleLowTrustBoundaryTarget,
+  getTrustPreset,
+  isCeLowTrustBoundaryEditable,
+  lowTrustBoundaryHasScope,
+  setSingleLowTrustBoundaryTarget,
+  summarizeLowTrustBoundaryTarget,
+  TRUST_PRESET_DESCRIPTIONS,
+  TRUST_PRESET_LABELS,
+  type LowTrustBoundaryTarget,
+} from "../lib/trust-policy-ui";
+import { cn } from "../lib/utils";
+
+const inputClass =
+  "w-full rounded-md border border-border px-2.5 py-1.5 bg-transparent outline-none text-sm font-mono placeholder:text-muted-foreground/40";
+
+function formatCount(value: readonly unknown[] | undefined, singular: string, plural: string) {
+  const count = value?.length ?? 0;
+  if (count === 0) return "-";
+  return `${count} ${count === 1 ? singular : plural}`;
+}
+
+function PolicyRow({ label, value }: { label: string; value: string }) {
+  return (
+    <div className="flex items-start justify-between gap-3 py-1.5 text-sm">
+      <span className="shrink-0 text-xs text-muted-foreground">{label}</span>
+      <span className={cn("min-w-0 text-right", value === "-" && "text-muted-foreground")}>{value}</span>
+    </div>
+  );
+}
+
+export interface LowTrustBoundaryCandidate {
+  id: string;
+  label: string;
+}
+
+type LowTrustBoundaryTargetType = LowTrustBoundaryTarget["type"];
+
+const BOUNDARY_TARGET_LABELS: Record<LowTrustBoundaryTargetType, string> = {
+  project: "Project",
+  root_issue: "Root issue",
+  issue: "Issue",
+};
+
+export function TrustPresetSection({
+  permissions,
+  onChange,
+  disabled,
+  companyId,
+  projectCandidates = [],
+  issueCandidates = [],
+  candidatesLoading,
+}: {
+  permissions: Partial<AgentPermissions> | null | undefined;
+  onChange: (permissions: Partial<AgentPermissions>) => void;
+  disabled?: boolean;
+  companyId?: string | null;
+  projectCandidates?: LowTrustBoundaryCandidate[];
+  issueCandidates?: LowTrustBoundaryCandidate[];
+  candidatesLoading?: boolean;
+}) {
+  const [policyOpen, setPolicyOpen] = useState(false);
+  const preset = getTrustPreset(permissions);
+  const boundary = getLowTrustBoundary(permissions);
+  const boundaryTarget = getSingleLowTrustBoundaryTarget(boundary);
+  const [targetType, setTargetType] = useState<LowTrustBoundaryTargetType>(boundaryTarget?.type ?? "project");
+  const lowTrust = preset === "low_trust_review";
+  const hasScope = lowTrustBoundaryHasScope(boundary);
+  const boundaryEditable = isCeLowTrustBoundaryEditable(boundary);
+  const policy = permissions?.authorizationPolicy ?? null;
+  const managedPermissions = useMemo(
+    () => buildPermissionsForTrustPreset(permissions, preset),
+    [permissions, preset],
+  );
+
+  useEffect(() => {
+    if (boundaryTarget) setTargetType(boundaryTarget.type);
+  }, [boundaryTarget?.type]);
+
+  function handlePresetChange(value: string) {
+    const nextPreset: TrustPreset = value === "low_trust_review" ? "low_trust_review" : "standard";
+    onChange(buildPermissionsForTrustPreset(permissions, nextPreset));
+  }
+
+  function handleBoundaryTargetChange(targetId: string) {
+    if (!companyId || !targetId) return;
+    onChange(setSingleLowTrustBoundaryTarget(permissions, companyId, { type: targetType, id: targetId }));
+  }
+
+  function handleClearBoundary() {
+    onChange(clearSingleLowTrustBoundaryTarget(permissions));
+  }
+
+  const targetCandidates = targetType === "project" ? projectCandidates : issueCandidates;
+  const boundaryValue = boundaryTarget?.type === targetType ? boundaryTarget.id : "";
+
+  return (
+    <div>
+      <h3 className="mb-3 text-sm font-medium">Trust</h3>
+      <div className="rounded-lg border border-border p-4 space-y-3">
+        <Field label="Trust preset" hint="Choose how broadly this agent can read and act on Paperclip work objects.">
+          <select
+            className={inputClass}
+            value={preset}
+            onChange={(event) => handlePresetChange(event.target.value)}
+            disabled={disabled}
+          >
+            <option value="standard">{TRUST_PRESET_LABELS.standard}</option>
+            <option value="low_trust_review">{TRUST_PRESET_LABELS.low_trust_review}</option>
+          </select>
+        </Field>
+        <p className="text-xs text-muted-foreground">{TRUST_PRESET_DESCRIPTIONS[preset]}</p>
+
+        {lowTrust ? (
+          <div
+            role={hasScope ? "status" : "alert"}
+            aria-live="polite"
+            className={cn(
+              "rounded-md border px-3 py-2.5 text-sm flex gap-2",
+              hasScope
+                ? "border-amber-500/30 bg-amber-500/10 text-amber-700 dark:text-amber-100"
+                : "border-destructive/30 bg-destructive/10 text-destructive",
+            )}
+          >
+            {hasScope ? (
+              <ShieldAlert className="mt-0.5 h-4 w-4 shrink-0" />
+            ) : (
+              <Lock className="mt-0.5 h-4 w-4 shrink-0" />
+            )}
+            <div className="min-w-0 flex-1 space-y-2">
+              <div>
+                <p className="font-medium">
+                  {hasScope ? "Containment active" : "Containment not configured"}
+                </p>
+                <p className="mt-1 text-xs leading-5">
+                  {hasScope
+                    ? "This agent can only read and mutate work inside its assigned review boundary. Raw output is quarantined from higher-trust agents until a trusted reviewer promotes it."
+                    : "This agent is set to low-trust review, but no project, root issue, or issue scope is set in the core policy. Add a scope before this agent can run without denial."}
+                </p>
+              </div>
+              {boundaryEditable ? (
+                <div className="rounded-md border border-border/70 bg-background/70 p-3 text-foreground space-y-3">
+                  <div className="grid gap-3 sm:grid-cols-[minmax(0,0.75fr)_minmax(0,1fr)]">
+                    <Field label="Boundary type">
+                      <select
+                        className={inputClass}
+                        value={targetType}
+                        onChange={(event) => setTargetType(event.target.value as LowTrustBoundaryTargetType)}
+                        disabled={disabled}
+                      >
+                        <option value="project">Project</option>
+                        <option value="root_issue">Root issue</option>
+                        <option value="issue">Issue</option>
+                      </select>
+                    </Field>
+                    <Field label={BOUNDARY_TARGET_LABELS[targetType]}>
+                      <select
+                        className={inputClass}
+                        value={boundaryValue}
+                        onChange={(event) => handleBoundaryTargetChange(event.target.value)}
+                        disabled={disabled || !companyId || candidatesLoading || targetCandidates.length === 0}
+                      >
+                        <option value="">
+                          {candidatesLoading
+                            ? "Loading…"
+                            : targetCandidates.length === 0
+                              ? `No ${targetType === "project" ? "projects" : "issues"} available`
+                              : "Select boundary"}
+                        </option>
+                        {targetCandidates.map((candidate) => (
+                          <option key={candidate.id} value={candidate.id}>
+                            {candidate.label}
+                          </option>
+                        ))}
+                      </select>
+                    </Field>
+                  </div>
+                  <div className="flex flex-wrap items-center justify-between gap-2">
+                    <p className="text-xs text-muted-foreground">
+                      CE saves one containment boundary at a time. Saved policies include this company id.
+                    </p>
+                    {boundaryTarget ? (
+                      <Button
+                        type="button"
+                        size="sm"
+                        variant="outline"
+                        className="h-7 px-2.5 text-xs"
+                        onClick={handleClearBoundary}
+                        disabled={disabled}
+                      >
+                        Clear boundary
+                      </Button>
+                    ) : null}
+                  </div>
+                </div>
+              ) : (
+                <div className="rounded-md border border-border/70 bg-background/70 p-3 text-foreground">
+                  <p className="text-sm font-medium">Managed by EE/API</p>
+                  <p className="mt-1 text-xs leading-5 text-muted-foreground">
+                    This policy has {summarizeLowTrustBoundaryTarget(boundary).toLowerCase()} and cannot be edited by the CE single-boundary editor.
+                  </p>
+                </div>
+              )}
+              <p className="text-xs text-muted-foreground">
+                Want to set more than one containment boundary?{" "}
+                <a
+                  className="underline underline-offset-2 hover:text-foreground"
+                  href="https://paperclip.ing/ee"
+                  target="_blank"
+                  rel="noreferrer"
+                >
+                  Get Paperclip EE.
+                </a>
+              </p>
+              <CollapsibleSection
+                title="View policy"
+                open={policyOpen}
+                onToggle={() => setPolicyOpen((open) => !open)}
+              >
+                <div className="divide-y divide-border/60 text-foreground">
+                  <PolicyRow label="Preset" value="Low-trust review v1" />
+                  <PolicyRow label="Raw output" value="Quarantined from higher-trust agents" />
+                  <PolicyRow label="Projects" value={formatCount(boundary?.projectIds, "project", "projects")} />
+                  <PolicyRow label="Root issue" value={boundary?.rootIssueId ? boundary.rootIssueId.slice(0, 8) : "-"} />
+                  <PolicyRow label="Explicit issues" value={formatCount(boundary?.issueIds, "issue", "issues")} />
+                  <PolicyRow label="Allowed agents" value={formatCount(boundary?.allowedAgentIds, "agent", "agents")} />
+                  <PolicyRow label="Allowed tools" value={boundary?.allowedToolClasses?.join(" · ") || "-"} />
+                  <PolicyRow label="Allowed secrets" value={formatCount(boundary?.allowedSecretBindingIds, "binding", "bindings")} />
+                  <PolicyRow label="Promotion target" value={boundary?.outputPromotionTarget?.issueId?.slice(0, 8) ?? "-"} />
+                  <PolicyRow
+                    label="EE fields"
+                    value={Object.keys(policy ?? {}).some((key) => !["trustPreset", "reviewPreset", "trustBoundary"].includes(key))
+                      ? "Custom advanced policy fields preserved"
+                      : "-"}
+                  />
+                </div>
+              </CollapsibleSection>
+            </div>
+          </div>
+        ) : null}
+
+        {managedPermissions.authorizationPolicy?.reviewPreset ? null : (
+          <p className="text-xs text-muted-foreground">
+            Advanced permissions remain editable through the EE permissions extension when installed.
+          </p>
+        )}
+      </div>
+    </div>
+  );
+}

ui/src/lib/issue-chat-messages.test.ts

@@ -53,6 +53,7 @@ function createComment(overrides: Partial<IssueChatComment> = {}): IssueChatComm
     authorType: authorAgentId ? "agent" : "user",
     presentation: null,
     metadata: null,
+    sourceTrust: null,
     createdAt: new Date("2026-04-06T12:00:00.000Z"),
     updatedAt: new Date("2026-04-06T12:00:00.000Z"),
     ...overrides,
@@ -350,6 +351,32 @@ describe("buildIssueChatMessages", () => {
     expect(JSON.stringify(messages[0])).not.toContain("Sensitive deleted body");
   });
 
+  it("preserves low-trust source metadata on comment messages", () => {
+    const messages = buildIssueChatMessages({
+      comments: [
+        createComment({
+          authorAgentId: "agent-1",
+          authorUserId: null,
+          sourceTrust: {
+            preset: "low_trust_review",
+            disposition: "quarantined",
+            sourceAgentId: "agent-1",
+          },
+        }),
+      ],
+      timelineEvents: [],
+      linkedRuns: [],
+      liveRuns: [],
+      agentMap: new Map([["agent-1", createAgent("agent-1", "Low Trust Reviewer")]]),
+    });
+
+    expect(messages[0]?.metadata.custom.sourceTrust).toMatchObject({
+      preset: "low_trust_review",
+      disposition: "quarantined",
+      sourceAgentId: "agent-1",
+    });
+  });
+
   it("prefers derived agent attribution when a board-authored comment is proven to come from a run", () => {
     const agentMap = new Map<string, Agent>([["agent-1", createAgent("agent-1", "Claude")]]);
     const messages = buildIssueChatMessages({

ui/src/lib/issue-chat-messages.ts

@@ -413,6 +413,7 @@ function createCommentMessage(args: {
     deletedByAgentId: comment.deletedByAgentId ?? null,
     deletedByUserId: comment.deletedByUserId ?? null,
     deletedByRunId: comment.deletedByRunId ?? null,
+    sourceTrust: comment.sourceTrust ?? null,
   };
   const contentText = comment.deletedAt ? "" : comment.body;
 

ui/src/lib/new-agent-hire-payload.test.ts

@@ -41,4 +41,53 @@ describe("buildNewAgentHirePayload", () => {
       defaultEnvironmentId: null,
     });
   });
+
+  it("includes core trust preset permissions when provided", () => {
+    expect(
+      buildNewAgentHirePayload({
+        name: "PR Reviewer",
+        effectiveRole: "engineer",
+        configValues: {
+          ...defaultCreateValues,
+          adapterType: "codex_local",
+        },
+        adapterConfig: {},
+        permissions: {
+          canCreateAgents: false,
+          trustPreset: "low_trust_review",
+          authorizationPolicy: {
+            trustPreset: "low_trust_review",
+            reviewPreset: {
+              id: "low_trust_review",
+              version: 1,
+              rawOutputDisposition: "quarantine",
+            },
+            trustBoundary: {
+              mode: "low_trust_review",
+              companyId: "company-1",
+              rootIssueId: "issue-root",
+            },
+          },
+        },
+      }),
+    ).toMatchObject({
+      permissions: {
+        canCreateAgents: false,
+        trustPreset: "low_trust_review",
+        authorizationPolicy: {
+          trustPreset: "low_trust_review",
+          reviewPreset: {
+            id: "low_trust_review",
+            version: 1,
+            rawOutputDisposition: "quarantine",
+          },
+          trustBoundary: {
+            mode: "low_trust_review",
+            companyId: "company-1",
+            rootIssueId: "issue-root",
+          },
+        },
+      },
+    });
+  });
 });

ui/src/lib/new-agent-hire-payload.ts

@@ -1,5 +1,6 @@
 import type { CreateConfigValues } from "../components/AgentConfigForm";
 import { buildNewAgentRuntimeConfig } from "./new-agent-runtime-config";
+import type { AgentPermissions } from "@paperclipai/shared";
 
 export function buildNewAgentHirePayload(input: {
   name: string;
@@ -9,6 +10,7 @@ export function buildNewAgentHirePayload(input: {
   selectedSkillKeys?: string[];
   configValues: CreateConfigValues;
   adapterConfig: Record<string, unknown>;
+  permissions?: Partial<AgentPermissions>;
 }) {
   const {
     name,
@@ -18,6 +20,7 @@ export function buildNewAgentHirePayload(input: {
     selectedSkillKeys = [],
     configValues,
     adapterConfig,
+    permissions,
   } = input;
 
   return {
@@ -36,5 +39,6 @@ export function buildNewAgentHirePayload(input: {
       cheapModelEnabled: configValues.cheapModelEnabled,
     }),
     budgetMonthlyCents: 0,
+    ...(permissions ? { permissions } : {}),
   };
 }

ui/src/lib/trust-policy-ui.test.ts

@@ -0,0 +1,117 @@
+// @vitest-environment node
+import { describe, expect, it } from "vitest";
+import {
+  clearSingleLowTrustBoundaryTarget,
+  getLowTrustBoundary,
+  getSingleLowTrustBoundaryTarget,
+  isCeLowTrustBoundaryEditable,
+  setSingleLowTrustBoundaryTarget,
+  summarizeLowTrustBoundaryTarget,
+} from "./trust-policy-ui";
+
+describe("trust-policy-ui low-trust boundary helpers", () => {
+  it("writes one project boundary with mode and company id", () => {
+    const permissions = setSingleLowTrustBoundaryTarget(null, "company-1", {
+      type: "project",
+      id: "project-1",
+    });
+
+    expect(permissions).toMatchObject({
+      trustPreset: "low_trust_review",
+      authorizationPolicy: {
+        trustPreset: "low_trust_review",
+        reviewPreset: {
+          id: "low_trust_review",
+          version: 1,
+          rawOutputDisposition: "quarantine",
+        },
+        trustBoundary: {
+          mode: "low_trust_review",
+          companyId: "company-1",
+          projectIds: ["project-1"],
+        },
+      },
+    });
+  });
+
+  it("clears other scope fields while preserving non-scope policy fields", () => {
+    const permissions = setSingleLowTrustBoundaryTarget(
+      {
+        trustPreset: "low_trust_review",
+        authorizationPolicy: {
+          customEeField: { mode: "preserved" },
+          trustBoundary: {
+            mode: "low_trust_review",
+            companyId: "company-1",
+            projectIds: ["project-1"],
+            rootIssueId: "root-1",
+            issueIds: ["issue-1"],
+            allowedToolClasses: ["git.read"],
+          },
+        },
+      },
+      "company-2",
+      { type: "issue", id: "issue-2" },
+    );
+
+    expect(permissions.authorizationPolicy).toMatchObject({
+      customEeField: { mode: "preserved" },
+      trustBoundary: {
+        mode: "low_trust_review",
+        companyId: "company-2",
+        issueIds: ["issue-2"],
+        allowedToolClasses: ["git.read"],
+      },
+    });
+    expect(permissions.authorizationPolicy?.trustBoundary?.projectIds).toBeUndefined();
+    expect(permissions.authorizationPolicy?.trustBoundary?.rootIssueId).toBeUndefined();
+  });
+
+  it("hydrates one existing root issue boundary", () => {
+    const boundary = getLowTrustBoundary({
+      trustPreset: "low_trust_review",
+      authorizationPolicy: {
+        trustBoundary: {
+          mode: "low_trust_review",
+          companyId: "company-1",
+          rootIssueId: "issue-root",
+        },
+      },
+    });
+
+    expect(getSingleLowTrustBoundaryTarget(boundary)).toEqual({ type: "root_issue", id: "issue-root" });
+    expect(summarizeLowTrustBoundaryTarget(boundary)).toBe("Root issue issue-ro");
+  });
+
+  it("marks multi-boundary policies read-only for CE", () => {
+    const boundary = {
+      mode: "low_trust_review" as const,
+      companyId: "company-1",
+      projectIds: ["project-1", "project-2"],
+    };
+
+    expect(isCeLowTrustBoundaryEditable(boundary)).toBe(false);
+    expect(getSingleLowTrustBoundaryTarget(boundary)).toBeNull();
+    expect(summarizeLowTrustBoundaryTarget(boundary)).toBe("2 boundaries");
+  });
+
+  it("clears the CE boundary without removing non-scope fields", () => {
+    const permissions = clearSingleLowTrustBoundaryTarget({
+      trustPreset: "low_trust_review",
+      authorizationPolicy: {
+        trustBoundary: {
+          mode: "low_trust_review",
+          companyId: "company-1",
+          issueIds: ["issue-1"],
+          allowedSecretBindingIds: ["binding-1"],
+        },
+      },
+    });
+
+    expect(permissions.authorizationPolicy?.trustBoundary).toEqual({
+      mode: "low_trust_review",
+      companyId: "company-1",
+      allowedSecretBindingIds: ["binding-1"],
+    });
+  });
+});

ui/src/lib/trust-policy-ui.ts

@@ -0,0 +1,177 @@
+import {
+  DEFAULT_TRUST_PRESET,
+  LOW_TRUST_REVIEW_PRESET,
+  LOW_TRUST_REVIEW_PRESET_VERSION,
+  LOW_TRUST_REVIEW_RAW_OUTPUT_DISPOSITION,
+  type AgentPermissions,
+  type LowTrustBoundary,
+  type SourceTrustMetadata,
+  type TrustAuthorizationPolicy,
+  type TrustPreset,
+} from "@paperclipai/shared";
+
+export type LowTrustBoundaryTarget =
+  | { type: "project"; id: string }
+  | { type: "root_issue"; id: string }
+  | { type: "issue"; id: string };
+
+export const TRUST_PRESET_LABELS: Record<TrustPreset, string> = {
+  standard: "Standard",
+  low_trust_review: "Low-trust review",
+};
+
+export const TRUST_PRESET_DESCRIPTIONS: Record<TrustPreset, string> = {
+  standard: "Company-visible collaboration. This is the default for normal work.",
+  low_trust_review:
+    "Contained for hostile or untrusted input. Narrow Paperclip API, quarantined output. Use for PR review and external-content triage.",
+};
+
+export function getTrustPreset(permissions: Partial<AgentPermissions> | null | undefined): TrustPreset {
+  return permissions?.trustPreset === LOW_TRUST_REVIEW_PRESET ? LOW_TRUST_REVIEW_PRESET : DEFAULT_TRUST_PRESET;
+}
+
+export function buildLowTrustReviewPolicy(
+  existing: TrustAuthorizationPolicy | null | undefined,
+): TrustAuthorizationPolicy {
+  return {
+    ...(existing ?? {}),
+    trustPreset: LOW_TRUST_REVIEW_PRESET,
+    reviewPreset: {
+      id: LOW_TRUST_REVIEW_PRESET,
+      version: LOW_TRUST_REVIEW_PRESET_VERSION,
+      rawOutputDisposition: LOW_TRUST_REVIEW_RAW_OUTPUT_DISPOSITION,
+    },
+  };
+}
+
+export function buildPermissionsForTrustPreset(
+  permissions: Partial<AgentPermissions> | null | undefined,
+  preset: TrustPreset,
+): Partial<AgentPermissions> {
+  const current = permissions ?? {};
+  if (preset === LOW_TRUST_REVIEW_PRESET) {
+    return {
+      ...current,
+      trustPreset: LOW_TRUST_REVIEW_PRESET,
+      authorizationPolicy: buildLowTrustReviewPolicy(current.authorizationPolicy),
+    };
+  }
+
+  const nextPolicy = { ...(current.authorizationPolicy ?? {}) } as TrustAuthorizationPolicy;
+  delete nextPolicy.trustPreset;
+  delete nextPolicy.reviewPreset;
+  delete nextPolicy.trustBoundary;
+
+  return {
+    ...current,
+    trustPreset: DEFAULT_TRUST_PRESET,
+    ...(Object.keys(nextPolicy).length > 0
+      ? { authorizationPolicy: nextPolicy }
+      : { authorizationPolicy: undefined }),
+  };
+}
+
+export function getLowTrustBoundary(
+  permissions: Partial<AgentPermissions> | null | undefined,
+): LowTrustBoundary | null {
+  const boundary = permissions?.authorizationPolicy?.trustBoundary;
+  return boundary?.mode === LOW_TRUST_REVIEW_PRESET ? boundary : null;
+}
+
+function countBoundaryTargets(boundary: LowTrustBoundary | null | undefined) {
+  return (
+    (boundary?.projectIds?.length ?? 0) +
+    (boundary?.rootIssueId ? 1 : 0) +
+    (boundary?.issueIds?.length ?? 0)
+  );
+}
+
+export function getSingleLowTrustBoundaryTarget(
+  boundary: LowTrustBoundary | null | undefined,
+): LowTrustBoundaryTarget | null {
+  if (!boundary || countBoundaryTargets(boundary) !== 1) return null;
+  const projectId = boundary.projectIds?.[0];
+  if (projectId) return { type: "project", id: projectId };
+  if (boundary.rootIssueId) return { type: "root_issue", id: boundary.rootIssueId };
+  const issueId = boundary.issueIds?.[0];
+  if (issueId) return { type: "issue", id: issueId };
+  return null;
+}
+
+export function isCeLowTrustBoundaryEditable(boundary: LowTrustBoundary | null | undefined) {
+  return countBoundaryTargets(boundary) <= 1;
+}
+
+export function setSingleLowTrustBoundaryTarget(
+  permissions: Partial<AgentPermissions> | null | undefined,
+  companyId: string,
+  target: LowTrustBoundaryTarget,
+): Partial<AgentPermissions> {
+  const current = buildPermissionsForTrustPreset(permissions, LOW_TRUST_REVIEW_PRESET);
+  const currentPolicy = current.authorizationPolicy ?? {};
+  const existingBoundary = currentPolicy.trustBoundary ?? { mode: LOW_TRUST_REVIEW_PRESET };
+  const { projectIds: _projectIds, rootIssueId: _rootIssueId, issueIds: _issueIds, ...nonScopeBoundary } = existingBoundary;
+  const trustBoundary: LowTrustBoundary = {
+    ...nonScopeBoundary,
+    mode: LOW_TRUST_REVIEW_PRESET,
+    companyId,
+    ...(target.type === "project" ? { projectIds: [target.id] } : {}),
+    ...(target.type === "root_issue" ? { rootIssueId: target.id } : {}),
+    ...(target.type === "issue" ? { issueIds: [target.id] } : {}),
+  };
+
+  return {
+    ...current,
+    authorizationPolicy: {
+      ...currentPolicy,
+      trustPreset: LOW_TRUST_REVIEW_PRESET,
+      reviewPreset: {
+        id: LOW_TRUST_REVIEW_PRESET,
+        version: LOW_TRUST_REVIEW_PRESET_VERSION,
+        rawOutputDisposition: LOW_TRUST_REVIEW_RAW_OUTPUT_DISPOSITION,
+      },
+      trustBoundary,
+    },
+  };
+}
+
+export function clearSingleLowTrustBoundaryTarget(
+  permissions: Partial<AgentPermissions> | null | undefined,
+): Partial<AgentPermissions> {
+  const current = buildPermissionsForTrustPreset(permissions, LOW_TRUST_REVIEW_PRESET);
+  const currentPolicy = current.authorizationPolicy ?? {};
+  const boundary = currentPolicy.trustBoundary;
+  if (!boundary) return current;
+  const { projectIds: _projectIds, rootIssueId: _rootIssueId, issueIds: _issueIds, ...nonScopeBoundary } = boundary;
+  return {
+    ...current,
+    authorizationPolicy: {
+      ...currentPolicy,
+      trustBoundary: {
+        ...nonScopeBoundary,
+        mode: LOW_TRUST_REVIEW_PRESET,
+      },
+    },
+  };
+}
+
+export function summarizeLowTrustBoundaryTarget(
+  boundary: LowTrustBoundary | null | undefined,
+) {
+  const target = getSingleLowTrustBoundaryTarget(boundary);
+  if (target?.type === "project") return `Project ${target.id.slice(0, 8)}`;
+  if (target?.type === "root_issue") return `Root issue ${target.id.slice(0, 8)}`;
+  if (target?.type === "issue") return `Issue ${target.id.slice(0, 8)}`;
+  if (!boundary || countBoundaryTargets(boundary) === 0) return "No boundary selected";
+  return `${countBoundaryTargets(boundary)} boundaries`;
+}
+
+export function lowTrustBoundaryHasScope(boundary: LowTrustBoundary | null | undefined) {
+  return countBoundaryTargets(boundary) > 0;
+}
+
+export function sourceTrustLabel(sourceTrust: SourceTrustMetadata | null | undefined) {
+  if (!sourceTrust || sourceTrust.preset !== LOW_TRUST_REVIEW_PRESET) return null;
+  if (sourceTrust.disposition === "promoted") return "Promoted from low-trust";
+  return "Low-trust source";
+}

ui/src/pages/AgentDetail.tsx

@@ -15,6 +15,7 @@ import { ApiError } from "../api/client";
 import { ChartCard, RunActivityChart, PriorityChart, IssueStatusChart, SuccessRateChart } from "../components/ActivityCharts";
 import { activityApi } from "../api/activity";
 import { issuesApi } from "../api/issues";
+import { projectsApi } from "../api/projects";
 import { usePanel } from "../context/PanelContext";
 import { useSidebar } from "../context/SidebarContext";
 import { useCompany } from "../context/CompanyContext";
@@ -41,6 +42,7 @@ import { Identity } from "../components/Identity";
 import { PageSkeleton } from "../components/PageSkeleton";
 import { RunButton, PauseResumeButton } from "../components/AgentActionButtons";
 import { BudgetPolicyCard } from "../components/BudgetPolicyCard";
+import { TrustPresetSection } from "../components/TrustPresetSection";
 import { FileTree, buildFileTree } from "../components/FileTree";
 import { ScrollToBottom } from "../components/ScrollToBottom";
 import { SourceResolvedFoldCallout } from "../components/SourceResolvedFoldCallout";
@@ -101,6 +103,7 @@ import {
   type LiveEvent,
   type WorkspaceOperation,
 } from "@paperclipai/shared";
+import { buildPermissionsForTrustPreset, getTrustPreset } from "../lib/trust-policy-ui";
 import { redactHomePathUserSegments, redactHomePathUserSegmentsInValue } from "@paperclipai/adapter-utils";
 import { agentRouteRef } from "../lib/utils";
 import {
@@ -1729,6 +1732,22 @@ function ConfigurationTab({
     enabled: Boolean(companyId),
   });
 
+  const lowTrustSelected = getTrustPreset(agent.permissions) === "low_trust_review";
+
+  const { data: boundaryProjects, isLoading: boundaryProjectsLoading } = useQuery({
+    queryKey: companyId ? queryKeys.projects.list(companyId) : ["projects", "__low-trust-disabled"],
+    queryFn: () => projectsApi.list(companyId!),
+    enabled: Boolean(companyId && lowTrustSelected),
+  });
+
+  const { data: boundaryIssues, isLoading: boundaryIssuesLoading } = useQuery({
+    queryKey: companyId
+      ? [...queryKeys.issues.list(companyId), "low-trust-boundary-candidates"]
+      : ["issues", "__low-trust-disabled"],
+    queryFn: () => issuesApi.list(companyId!, { limit: 100, sortField: "updated", sortDir: "desc" }),
+    enabled: Boolean(companyId && lowTrustSelected),
+  });
+
   const updateAgent = useMutation({
     mutationFn: (data: Record<string, unknown>) => agentsApi.update(agent.id, data, companyId),
     onMutate: () => {
@@ -1796,6 +1815,28 @@ function ConfigurationTab({
         sectionLayout="cards"
       />
 
+      <TrustPresetSection
+        permissions={agent.permissions}
+        disabled={updatePermissions.isPending}
+        companyId={companyId}
+        projectCandidates={(boundaryProjects ?? []).map((project) => ({
+          id: project.id,
+          label: project.name,
+        }))}
+        issueCandidates={(boundaryIssues ?? []).map((issue) => ({
+          id: issue.id,
+          label: `${issue.identifier ?? issue.id.slice(0, 8)} · ${issue.title}`,
+        }))}
+        candidatesLoading={boundaryProjectsLoading || boundaryIssuesLoading}
+        onChange={(nextPermissions) =>
+          updatePermissions.mutate({
+            canCreateAgents,
+            canAssignTasks,
+            ...buildPermissionsForTrustPreset(nextPermissions, nextPermissions.trustPreset === "low_trust_review" ? "low_trust_review" : "standard"),
+          })
+        }
+      />
+
       <div>
         <h3 className="text-sm font-medium mb-3">Permissions</h3>
         <div className="border border-border rounded-lg p-4 space-y-4">

ui/src/pages/NewAgent.tsx

@@ -5,8 +5,10 @@ import { useCompany } from "../context/CompanyContext";
 import { useBreadcrumbs } from "../context/BreadcrumbContext";
 import { agentsApi } from "../api/agents";
 import { companySkillsApi } from "../api/companySkills";
+import { issuesApi } from "../api/issues";
+import { projectsApi } from "../api/projects";
 import { queryKeys } from "../lib/queryKeys";
-import { AGENT_ROLES, type AdapterEnvironmentTestResult } from "@paperclipai/shared";
+import { AGENT_ROLES, type AdapterEnvironmentTestResult, type AgentPermissions } from "@paperclipai/shared";
 import { Button } from "@/components/ui/button";
 import { Checkbox } from "@/components/ui/checkbox";
 import {
@@ -28,6 +30,8 @@ import { useDisabledAdaptersSync } from "../adapters/use-disabled-adapters";
 import { isValidAdapterType } from "../adapters/metadata";
 import { ReportsToPicker } from "../components/ReportsToPicker";
 import { buildNewAgentHirePayload } from "../lib/new-agent-hire-payload";
+import { TrustPresetSection } from "../components/TrustPresetSection";
+import { buildPermissionsForTrustPreset, getTrustPreset } from "../lib/trust-policy-ui";
 import {
   DEFAULT_CODEX_LOCAL_BYPASS_APPROVALS_AND_SANDBOX,
   DEFAULT_CODEX_LOCAL_MODEL,
@@ -68,6 +72,9 @@ export function NewAgent() {
   const [role, setRole] = useState("general");
   const [reportsTo, setReportsTo] = useState<string | null>(null);
   const [configValues, setConfigValues] = useState<CreateConfigValues>(defaultCreateValues);
+  const [permissions, setPermissions] = useState<Partial<AgentPermissions>>(
+    buildPermissionsForTrustPreset(null, "standard"),
+  );
   const [selectedSkillKeys, setSelectedSkillKeys] = useState<string[]>([]);
   const [roleOpen, setRoleOpen] = useState(false);
   const [formError, setFormError] = useState<string | null>(null);
@@ -93,6 +100,22 @@ export function NewAgent() {
     enabled: Boolean(selectedCompanyId),
   });
 
+  const lowTrustSelected = getTrustPreset(permissions) === "low_trust_review";
+
+  const { data: boundaryProjects, isLoading: boundaryProjectsLoading } = useQuery({
+    queryKey: selectedCompanyId ? queryKeys.projects.list(selectedCompanyId) : ["projects", "__low-trust-disabled"],
+    queryFn: () => projectsApi.list(selectedCompanyId!),
+    enabled: Boolean(selectedCompanyId && lowTrustSelected),
+  });
+
+  const { data: boundaryIssues, isLoading: boundaryIssuesLoading } = useQuery({
+    queryKey: selectedCompanyId
+      ? [...queryKeys.issues.list(selectedCompanyId), "low-trust-boundary-candidates"]
+      : ["issues", "__low-trust-disabled"],
+    queryFn: () => issuesApi.list(selectedCompanyId!, { limit: 100, sortField: "updated", sortDir: "desc" }),
+    enabled: Boolean(selectedCompanyId && lowTrustSelected),
+  });
+
   const isFirstAgent = !agents || agents.length === 0;
   const effectiveRole = isFirstAgent ? "ceo" : role;
 
@@ -156,6 +179,7 @@ export function NewAgent() {
         selectedSkillKeys,
         configValues,
         adapterConfig: buildAdapterConfig(),
+        permissions,
       }),
     );
   }
@@ -256,6 +280,24 @@ export function NewAgent() {
           />
         </div>
 
+        <div className="border-t border-border px-4 py-4">
+          <TrustPresetSection
+            permissions={permissions}
+            onChange={setPermissions}
+            disabled={createAgent.isPending}
+            companyId={selectedCompanyId}
+            projectCandidates={(boundaryProjects ?? []).map((project) => ({
+              id: project.id,
+              label: project.name,
+            }))}
+            issueCandidates={(boundaryIssues ?? []).map((issue) => ({
+              id: issue.id,
+              label: `${issue.identifier ?? issue.id.slice(0, 8)} · ${issue.title}`,
+            }))}
+            candidatesLoading={boundaryProjectsLoading || boundaryIssuesLoading}
+          />
+        </div>
+
         {/* Shared config form */}
         <AgentConfigForm
           mode="create"