Add files via upload

internal/security/rbac.go

@@ -19,6 +19,7 @@ var PermissionCatalog = map[string]string{
 	"chat:write":           "Create and update conversations",
 	"chat:delete":          "Delete conversations and turns",
 	"agent:execute":        "Run AI agents and workflows",
+	"agent:local-execute":  "Use local filesystem, shell, and configured command tools from an agent",
 	"hitl:read":            "View HITL queues and logs",
 	"hitl:write":           "Approve, dismiss, and configure HITL",
 	"tasks:read":           "View task queues",
@@ -37,7 +38,9 @@ var PermissionCatalog = map[string]string{
 	"c2:write":             "Operate C2 listeners, sessions, tasks, payloads, files, and profiles",
 	"c2:delete":            "Delete C2 objects",
 	"mcp:read":             "View MCP status and external MCP configuration",
-	"mcp:write":            "Manage external MCP servers and invoke MCP endpoint",
+	"mcp:execute":          "Invoke the authenticated MCP endpoint",
+	"mcp:external:execute": "Invoke tools exposed by configured external MCP servers",
+	"mcp:write":            "Manage external MCP server configuration and lifecycle",
 	"knowledge:read":       "View knowledge base and retrieval logs",
 	"knowledge:write":      "Create, update, index, and scan knowledge base",
 	"knowledge:delete":     "Delete knowledge items and retrieval logs",
@@ -51,7 +54,8 @@ var PermissionCatalog = map[string]string{
 	"roles:write":          "Create and update AI testing roles",
 	"roles:delete":         "Delete AI testing roles",
 	"workflow:read":        "View workflow definitions and runs",
-	"workflow:write":       "Create, update, validate, run, and resume workflows",
+	"workflow:execute":     "Validate, dry-run, and resume authorized workflow runs",
+	"workflow:write":       "Create and update workflow definitions",
 	"workflow:delete":      "Delete workflows",
 	"config:read":          "View system configuration",
 	"config:write":         "Update and apply system configuration",