diff --git a/agents/admin.md b/agents/admin.md
index d87db1f..8935389 100644
--- a/agents/admin.md
+++ b/agents/admin.md
@@ -3,22 +3,48 @@ description: "Системный администратор — ОС, systemd, 
   пакеты, бэкапы, логи. Каждое изменение — после одобрения детального плана
   с бэкапом, тестом и откатом."
 mode: all
-temperature: 0.1
+request:
+  body:
+    temperature: 0.1
 steps: 100
 color: "#16a34a"
-permission:
-  task: deny
-  bash: allow
-  read: allow
-  edit: allow
-  write: allow
-  grep: allow
-  glob: allow
-  websearch: allow
-  webfetch: allow
-  todowrite: allow
-  question: allow
-  skill: allow
+permissions:
+  - action: subagent
+    resource: "*"
+    effect: deny
+  - action: shell
+    resource: "*"
+    effect: allow
+  - action: read
+    resource: "*"
+    effect: allow
+  - action: edit
+    resource: "*"
+    effect: allow
+  - action: write
+    resource: "*"
+    effect: allow
+  - action: grep
+    resource: "*"
+    effect: allow
+  - action: glob
+    resource: "*"
+    effect: allow
+  - action: websearch
+    resource: "*"
+    effect: allow
+  - action: webfetch
+    resource: "*"
+    effect: allow
+  - action: todowrite
+    resource: "*"
+    effect: allow
+  - action: question
+    resource: "*"
+    effect: allow
+  - action: skill
+    resource: "*"
+    effect: allow
 ---
 
 # Системный администратор
diff --git a/agents/devops.md b/agents/devops.md
index 9ffa119..ad570cb 100644
--- a/agents/devops.md
+++ b/agents/devops.md
@@ -3,22 +3,48 @@ description: "DevOps-инженер — CI/CD, контейнеры, IaC, деп
   Готовит изменения как код и проверяет их dry-run. Применение и коммиты —
   только за пользователем."
 mode: all
-temperature: 0.1
+request:
+  body:
+    temperature: 0.1
 steps: 100
 color: "#2563eb"
-permission:
-  task: deny
-  bash: allow
-  read: allow
-  edit: allow
-  write: allow
-  grep: allow
-  glob: allow
-  websearch: allow
-  webfetch: allow
-  todowrite: allow
-  question: allow
-  skill: allow
+permissions:
+  - action: subagent
+    resource: "*"
+    effect: deny
+  - action: shell
+    resource: "*"
+    effect: allow
+  - action: read
+    resource: "*"
+    effect: allow
+  - action: edit
+    resource: "*"
+    effect: allow
+  - action: write
+    resource: "*"
+    effect: allow
+  - action: grep
+    resource: "*"
+    effect: allow
+  - action: glob
+    resource: "*"
+    effect: allow
+  - action: websearch
+    resource: "*"
+    effect: allow
+  - action: webfetch
+    resource: "*"
+    effect: allow
+  - action: todowrite
+    resource: "*"
+    effect: allow
+  - action: question
+    resource: "*"
+    effect: allow
+  - action: skill
+    resource: "*"
+    effect: allow
 ---
 
 # DevOps-инженер
diff --git a/agents/fixer.md b/agents/fixer.md
index 8dac41d..49115e2 100644
--- a/agents/fixer.md
+++ b/agents/fixer.md
@@ -2,7 +2,9 @@
 mode: all
 description: "Bug Fix — находит причину бага, чинит, проверяет что не сломал
   остальное. Работает строго по циклу: Investigate → Fix → Verify."
-temperature: 0.2
+request:
+  body:
+    temperature: 0.2
 steps: 100
 color: "#800080"
 ---
diff --git a/agents/leader.md b/agents/leader.md
index b01d3ab..1e73135 100644
--- a/agents/leader.md
+++ b/agents/leader.md
@@ -2,24 +2,54 @@
 description: Оркестратор — получает задачу, выбирает профиль, делегирует
   сабагентам. Сам код НЕ правит. Координирует выполнение и собирает результат.
 mode: primary
-temperature: 0.15
+request:
+  body:
+    temperature: 0.15
 steps: 200
 color: "#ffd43b"
-permission:
-  task: allow
-  bash: allow
-  read: allow
-  edit: allow
-  write: allow
-  websearch: allow
-  webfetch: allow
-  todowrite: allow
-  skill: allow
-  question: allow
-  plan_enter: allow
-  plan_exit: allow
-  grep: allow
-  glob: allow
+permissions:
+  - action: subagent
+    resource: "*"
+    effect: allow
+  - action: shell
+    resource: "*"
+    effect: allow
+  - action: read
+    resource: "*"
+    effect: allow
+  - action: edit
+    resource: "*"
+    effect: allow
+  - action: write
+    resource: "*"
+    effect: allow
+  - action: websearch
+    resource: "*"
+    effect: allow
+  - action: webfetch
+    resource: "*"
+    effect: allow
+  - action: todowrite
+    resource: "*"
+    effect: allow
+  - action: skill
+    resource: "*"
+    effect: allow
+  - action: question
+    resource: "*"
+    effect: allow
+  - action: plan_enter
+    resource: "*"
+    effect: allow
+  - action: plan_exit
+    resource: "*"
+    effect: allow
+  - action: grep
+    resource: "*"
+    effect: allow
+  - action: glob
+    resource: "*"
+    effect: allow
 ---
 
 # Orchestrator — оркестратор задач
diff --git a/agents/researcher.md b/agents/researcher.md
index 1400173..59296fb 100644
--- a/agents/researcher.md
+++ b/agents/researcher.md
@@ -11,9 +11,6 @@ permissions:
   - action: shell
     resource: "*"
     effect: allow
-  - action: shell
-    resource: ls *
-    effect: allow
   - action: webfetch
     resource: "*"
     effect: deny
@@ -64,4 +61,4 @@ permissions:
 - Исследуй тщательно. Не ограничивайся поверхностным поиском.
 - Используй grep с разными паттернами: точные имена, camelCase, kebab-case, импорты.
 - Ответ должен быть структурирован — с заголовками, списками, путями к файлам.
-- Если не можешь ответить полно — скажи что ещё нужно проверить.
\ No newline at end of file
+- Если не можешь ответить полно — скажи что ещё нужно проверить.
diff --git a/agents/tester.md b/agents/tester.md
index ff8397a..2a15ead 100644
--- a/agents/tester.md
+++ b/agents/tester.md
@@ -2,13 +2,21 @@
 description: Тестировщик, QA-инженер. Находит баги, проверяет фиксы, запускает
   тесты, верифицирует что ничего не сломано. Read-only.
 mode: all
-temperature: 0.1
+request:
+  body:
+    temperature: 0.1
 steps: 50
 color: "#ff6b6b"
-permission:
-  bash: allow
-  webfetch: deny
-  websearch: deny
+permissions:
+  - action: shell
+    resource: "*"
+    effect: allow
+  - action: webfetch
+    resource: "*"
+    effect: deny
+  - action: websearch
+    resource: "*"
+    effect: deny
 ---
 
 # Тестировщик, QA-инженер