diff --git a/services/hermes/chat-statefulset.yaml b/services/hermes/chat-statefulset.yaml
index 4ac29004..8223d98a 100644
--- a/services/hermes/chat-statefulset.yaml
+++ b/services/hermes/chat-statefulset.yaml
@@ -444,7 +444,7 @@ spec:
             - {name: HUX_RUNTIME_ENABLED, value: "1"}
             # First rollout is observe-only until approval parking/resume is
             # connected to the upstream tool loop and proven live.
-            - {name: HUX_TOOL_ENFORCEMENT, value: "1"}
+            - {name: HUX_TOOL_ENFORCEMENT, value: "0"}
             - {name: HUX_WORKER_KEY_FILE, value: /run/hermes-hux-worker/worker-key}
             - {name: HUX_SUBJECT_FILE, value: /run/hermes-hux-subject/subject}
             - {name: HUX_CONTEXT_KEY_FILE, value: /run/hermes-hux-context/context-key}
diff --git a/services/hermes/plugins/hux-runtime/tool_policy.py b/services/hermes/plugins/hux-runtime/tool_policy.py
index 68862885..1277937e 100644
--- a/services/hermes/plugins/hux-runtime/tool_policy.py
+++ b/services/hermes/plugins/hux-runtime/tool_policy.py
@@ -26,14 +26,30 @@ EXACT = {
     "memory": ToolPolicy("memory_write", "medium", False),
     "delegate_task": ToolPolicy("delegate", "high", False),
     "terminal": ToolPolicy("shell", "high", True),
-    "python": ToolPolicy("shell", "high", True),
+    # The Python sandbox is isolated by design; it is internal shell work,
+    # unlike the real terminal above.
+    "python": ToolPolicy("shell", "medium", False),
+    "python_sandbox": ToolPolicy("shell", "medium", False),
+    # Core assistant faculties are reads, not side effects.
+    "skills": ToolPolicy("read_files", "low", False),
+    "clarify": ToolPolicy("read_files", "low", False),
+    "todo": ToolPolicy("read_files", "low", False),
+    "vision": ToolPolicy("read_files", "low", False),
+    # Browsing is the product; it is network, not an unknown side effect.
+    "browser": ToolPolicy("network", "medium", True),
+    "web": ToolPolicy("network", "medium", True),
+    "web_search": ToolPolicy("network", "medium", True),
+    # Image generation produces an artifact through the trusted broker.
+    "image_gen": ToolPolicy("artifact_write", "medium", False),
 }
 
 PREFIXES = (
-    (("web_", "browser_", "http_", "mcp_"), ToolPolicy("network", "high", True)),
+    (("skill_", "skills_", "todo_", "clarify_"), ToolPolicy("read_files", "low", False)),
+    (("web_", "browser_", "http_", "mcp_"), ToolPolicy("network", "medium", True)),
     (("send_", "mail_", "email_", "slack_", "discord_", "telegram_"), ToolPolicy("send_message", "high", True)),
     (("kubectl_", "flux_", "deploy_", "release_"), ToolPolicy("deploy", "high", True)),
-    (("image_", "video_", "vision_"), ToolPolicy("external_side_effect", "high", True)),
+    (("image_",), ToolPolicy("artifact_write", "medium", False)),
+    (("video_", "vision_"), ToolPolicy("read_files", "low", False)),
     (("artifact_",), ToolPolicy("artifact_write", "medium", False)),
     (("memory_",), ToolPolicy("memory_write", "medium", False)),
     (("delegate_", "subagent_"), ToolPolicy("delegate", "high", False)),
diff --git a/testing/tests/test_hermes_hux_runtime_plugin.py b/testing/tests/test_hermes_hux_runtime_plugin.py
index 17488e8a..7f97f72b 100644
--- a/testing/tests/test_hermes_hux_runtime_plugin.py
+++ b/testing/tests/test_hermes_hux_runtime_plugin.py
@@ -161,10 +161,10 @@ def test_context_key_handles_short_read(monkeypatch, tmp_path: Path):
         ("memory", "memory_write", "medium", False),
         ("delegate_task", "delegate", "high", False),
         ("terminal", "shell", "high", True),
-        ("web_search", "network", "high", True),
+        ("web_search", "network", "medium", True),
         ("send_email", "send_message", "high", True),
         ("kubectl_apply", "deploy", "high", True),
-        ("image_generate", "external_side_effect", "high", True),
+        ("image_generate", "artifact_write", "medium", False),
         ("artifact_create", "artifact_write", "medium", False),
         ("memory_forget", "memory_write", "medium", False),
         ("subagent_spawn", "delegate", "high", False),