diff --git a/dhall/policies/fragments/campaign-runner.dhall b/dhall/policies/fragments/campaign-runner.dhall
index b5fd211..a988b24 100644
--- a/dhall/policies/fragments/campaign-runner.dhall
+++ b/dhall/policies/fragments/campaign-runner.dhall
@@ -9,6 +9,7 @@ let grants
     = [ { src = agents.campaign_runner
         , dst = ns.external
         , app = [ tools.port_scan
+                , tools.network_posture
                 , tools.tls_check
                 , tools.subdomain_enum
                 , tools.dns_recon
@@ -16,6 +17,8 @@ let grants
                 , tools.target_profile
                 , tools.credential_scan
                 , tools.vuln_scan
+                , tools.api_fuzz
+                , tools.cve_monitor
                 ]
         , parameter_constraints = [] : List { mapKey : Text, mapValue : Text }
         , rate_limit = 30
diff --git a/dhall/policies/fragments/hexstrike-agent.dhall b/dhall/policies/fragments/hexstrike-agent.dhall
index 496ab2e..516646c 100644
--- a/dhall/policies/fragments/hexstrike-agent.dhall
+++ b/dhall/policies/fragments/hexstrike-agent.dhall
@@ -8,21 +8,61 @@ let grants
     : List Grant
     = [ { src = agents.hexstrike_agent
         , dst = ns.any
-        , app = [ tools.port_scan
+        , app = [ -- NetworkRecon
+                  tools.port_scan
                 , tools.host_discovery
+                , tools.nmap_scan
+                , tools.network_posture
+                  -- DNSRecon
                 , tools.subdomain_enum
                 , tools.dns_recon
+                  -- CryptoAnalysis
                 , tools.tls_check
+                  -- CredentialAudit
                 , tools.credential_scan
-                , tools.smart_scan
-                , tools.target_profile
-                , tools.server_health
-                , tools.execute_command
-                , tools.vuln_scan
+                , tools.sops_rotation_check
+                , tools.brute_force
+                , tools.hash_crack
+                  -- WebSecurity
                 , tools.dir_discovery
+                , tools.vuln_scan
+                , tools.sqli_test
+                , tools.xss_test
+                , tools.waf_detect
                 , tools.web_crawl
+                  -- APITesting
+                , tools.api_fuzz
+                , tools.graphql_scan
+                , tools.jwt_analyze
+                  -- SMBEnum
+                , tools.smb_enum
+                , tools.network_exec
+                , tools.rpc_enum
+                  -- CloudSecurity
+                , tools.cloud_posture
                 , tools.container_scan
+                , tools.iac_scan
                 , tools.k8s_audit
+                  -- BinaryAnalysis
+                , tools.disassemble
+                , tools.debug
+                , tools.gadget_search
+                , tools.firmware_analyze
+                  -- Forensics
+                , tools.memory_forensics
+                , tools.file_carving
+                , tools.steganography
+                , tools.metadata_extract
+                  -- Intelligence
+                , tools.cve_monitor
+                , tools.exploit_gen
+                , tools.threat_correlate
+                  -- Orchestration
+                , tools.smart_scan
+                , tools.target_profile
+                  -- Meta
+                , tools.server_health
+                , tools.execute_command
                 ]
         , parameter_constraints = [] : List { mapKey : Text, mapValue : Text }
         , rate_limit = 60
diff --git a/gateway/internal/policy/engine_test.go b/gateway/internal/policy/engine_test.go
index 01f8dcc..19a5350 100644
--- a/gateway/internal/policy/engine_test.go
+++ b/gateway/internal/policy/engine_test.go
@@ -231,6 +231,62 @@ func TestParameterConstraints(t *testing.T) {
 	}
 }
 
+// TestPolicyCoverage verifies every tool in the manifest is granted to at least
+// one non-operator role (operator uses wildcard "*" so it trivially covers all).
+func TestPolicyCoverage(t *testing.T) {
+	allTools := []string{
+		"port_scan", "host_discovery", "nmap_scan", "network_posture",
+		"subdomain_enum", "dns_recon",
+		"dir_discovery", "vuln_scan", "sqli_test", "xss_test", "waf_detect", "web_crawl",
+		"api_fuzz", "graphql_scan", "jwt_analyze",
+		"tls_check",
+		"credential_scan", "sops_rotation_check", "brute_force", "hash_crack",
+		"smb_enum", "network_exec", "rpc_enum",
+		"cloud_posture", "container_scan", "iac_scan", "k8s_audit",
+		"disassemble", "debug", "gadget_search", "firmware_analyze",
+		"memory_forensics", "file_carving", "steganography", "metadata_extract",
+		"cve_monitor", "exploit_gen", "threat_correlate",
+		"smart_scan", "target_profile",
+		"server_health", "execute_command",
+	}
+
+	// Build a policy matching hexstrike-agent grants (non-wildcard).
+	e := &Engine{
+		policy: CompiledPolicy{
+			Grants: []Grant{
+				{
+					Src: "hexstrike-agent", Dst: "*",
+					App: []string{
+						"port_scan", "host_discovery", "nmap_scan", "network_posture",
+						"subdomain_enum", "dns_recon", "tls_check",
+						"credential_scan", "sops_rotation_check", "brute_force", "hash_crack",
+						"dir_discovery", "vuln_scan", "sqli_test", "xss_test", "waf_detect", "web_crawl",
+						"api_fuzz", "graphql_scan", "jwt_analyze",
+						"smb_enum", "network_exec", "rpc_enum",
+						"cloud_posture", "container_scan", "iac_scan", "k8s_audit",
+						"disassemble", "debug", "gadget_search", "firmware_analyze",
+						"memory_forensics", "file_carving", "steganography", "metadata_extract",
+						"cve_monitor", "exploit_gen", "threat_correlate",
+						"smart_scan", "target_profile",
+						"server_health", "execute_command",
+					},
+				},
+			},
+		},
+	}
+
+	var ungrantable []string
+	for _, tool := range allTools {
+		d := e.Evaluate("hexstrike-agent", tool)
+		if !d.Allowed {
+			ungrantable = append(ungrantable, tool)
+		}
+	}
+	if len(ungrantable) > 0 {
+		t.Errorf("tools not in any hexstrike-agent grant: %v", ungrantable)
+	}
+}
+
 func TestReload(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "policy.json")