[EW] define capability and permission model

[anfibiacreativa]

Propose the capability surface for generated tools, such as content.read, content.write, media.read, media.write, and any restrictions on outbound network access.