[AW Top 10] 08 Fix tool allowlist denials that abort agent runs #75853

Priority 8/10 | 8 source issues | Impact 4/5 | Confidence 3/5 | Effort 3/5

One assignment, one coherent fix

Agents are denied bash, GitHub read or MCP tools by the workflow allowlist, causing permission_denied exits, missing-tool reports and stopped scans.

Implementation scope

Audit the compiled allowlists for the affected workflows and the Copilot CLI denial handling, add the required tools or make the agent degrade gracefully, and classify denials distinctly from driver crashes.

Done when

• Each affected workflow compiles with the tools its prompt requires or avoids requiring them.
• A test asserts that an allowlist denial yields a clear classified failure rather than a generic CLI exit.

Why now

Four Copilot workflows failed with the same denial signature in 24 hours and container scans stopped repeatedly for the same reason; evidence is corroborated by several reports but varies by workflow.

Unchanged AW sources close only after this summary is completed. Newer source activity and not-planned retirement do not trigger source closure. Assigned summaries are frozen; unassign to allow reclustering.

Generated by AW Essential Issue Clustering · copilot · auto · ~27 AIC · ⌖ ~2 AIC · ⊞ 9.7K · ◷