diff --git a/AGENTS.md b/AGENTS.md
index ba1804a5..e6c46dda 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -211,6 +211,7 @@ fail-closed and only pauses when the agent actually proposed a reviewed output.
 │   │   ├── add_pr_comment.rs
 │   │   ├── assign_github_issue_milestone.rs
 │   │   ├── assign_github_issue_to_user.rs
+│   │   ├── assign_work_item.rs
 │   │   ├── close_github_issue.rs
 │   │   ├── comment_on_github_issue.rs
 │   │   ├── comment_on_work_item.rs
diff --git a/docs/front-matter.md b/docs/front-matter.md
index bddcfd9f..686e9338 100644
--- a/docs/front-matter.md
+++ b/docs/front-matter.md
@@ -271,6 +271,9 @@ permissions:                   # optional ADO access token configuration (see do
                                  # Default: executor uses $(System.AccessToken).
                                  # Set this only for cross-org writes or
                                  # named-identity attribution.
+# permissions-required:          # optional abstract read/write requirements unioned across
+#   read: true                   # imported components; see docs/imports.md#permissions-required
+#   write: false
 supply-chain:                  # optional internal supply-chain mirror (see docs/supply-chain.md)
   feed:                          # mirror binaries (compiler, AWF, ado-script) from an ADO Artifacts feed
     name: my-project/my-feed     # feed name or project/feed; scalar `feed: my-feed` shorthand also works