namespace: maiyesh.arena
purpose:   arena.product_trial

human.maiyesh-owner
  → maiyesh.scout
      tools: maiyesh.probe (invoke)
      files: maiyesh/raw/* (create|replace|read|list)
      escalate: sharedos/escalation (request)
  → maiyesh.schema
      files: maiyesh/raw/* (read|list|search|grep)
      DENIED: maiyesh.probe
  → maiyesh.judge
      files: maiyesh/raw/* (read|list)
      files: maiyesh/reports/* (create|replace|read|list)
      DENIED: maiyesh.probe

deny by default: secrets/*, net.*, pay.*, any path outside grants
escalation: target demands credentials, second-hop fan-out, oversize payload