diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index a492749..da0c7cd 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -45,4 +45,14 @@ jobs:
             echo "::error::no plugin.yaml files found under plugins/"
             exit 1
           fi
-          /tmp/spawn plugin validate "${specs[@]}"
+          # Prefer the publish-time strict check (permissions/step consistency,
+          # spore-plugins#8), which requires a spawn new enough to have --strict.
+          # Fall back to plain validate on an older released spawn so CI doesn't
+          # break in the window before that spawn release ships.
+          if /tmp/spawn plugin validate --help 2>&1 | grep -q -- --strict; then
+            echo "Using strict validation (permissions/step consistency)"
+            /tmp/spawn plugin validate --strict "${specs[@]}"
+          else
+            echo "::warning::downloaded spawn lacks --strict; running plain validation (upgrade once spawn with --strict is released)"
+            /tmp/spawn plugin validate "${specs[@]}"
+          fi
diff --git a/plugins/globus-personal-endpoint/plugin.yaml b/plugins/globus-personal-endpoint/plugin.yaml
index 7e3012a..2c7b67d 100644
--- a/plugins/globus-personal-endpoint/plugin.yaml
+++ b/plugins/globus-personal-endpoint/plugin.yaml
@@ -1,5 +1,5 @@
 name: globus-personal-endpoint
-version: v1.1.0
+version: v1.2.0
 description: "Install Globus Connect Personal for high-speed data transfer"
 author: spore-host
 license: Apache-2.0
@@ -15,6 +15,17 @@ license: Apache-2.0
 #      Opens a browser to authenticate; use `globus login --no-local-server` on a
 #      headless controller. Verify with `globus whoami`.
 
+permissions:
+  controller:
+    network: true # globus-cli registers/deletes the endpoint via the Globus API
+    commands:
+      - globus
+  instance:
+    root: true # the install step fetches + unpacks GCP into /opt as root
+    network: true # downloads Globus Connect Personal and connects to Globus
+    files:
+      - /opt/globus-connect-personal
+
 config:
   display_name:
     type: string
diff --git a/plugins/rstudio-server/plugin.yaml b/plugins/rstudio-server/plugin.yaml
index bac8154..3ef77db 100644
--- a/plugins/rstudio-server/plugin.yaml
+++ b/plugins/rstudio-server/plugin.yaml
@@ -1,9 +1,16 @@
 name: rstudio-server
-version: v1.0.1
+version: v1.1.0
 description: "Install and start RStudio Server for browser-based R development"
 author: spore-host
 license: Apache-2.0
 
+permissions:
+  instance:
+    root: true # dnf/dpkg install, useradd, systemctl all run as root
+    network: true # downloads R + RStudio Server packages
+    ports:
+      - 8787 # RStudio Server web UI
+
 config:
   r_version:
     type: string
diff --git a/plugins/spore-sync/plugin.yaml b/plugins/spore-sync/plugin.yaml
index 7dbdbd6..1dee874 100644
--- a/plugins/spore-sync/plugin.yaml
+++ b/plugins/spore-sync/plugin.yaml
@@ -1,9 +1,18 @@
 name: spore-sync
-version: v1.1.0
+version: v1.2.0
 description: "Live bidirectional directory sync between local machine and instance using mutagen"
 author: spore-host
 license: Apache-2.0
 
+permissions:
+  controller:
+    network: true # mutagen connects to the instance over SSH to sync
+    commands:
+      - mutagen
+  instance:
+    root: true # installs rsync via the system package manager
+    network: false # no outbound network from the instance side
+
 config:
   local_path:
     type: string
diff --git a/plugins/tailscale/plugin.yaml b/plugins/tailscale/plugin.yaml
index 9b55cd1..0dc8696 100644
--- a/plugins/tailscale/plugin.yaml
+++ b/plugins/tailscale/plugin.yaml
@@ -1,5 +1,5 @@
 name: tailscale
-version: v2.0.0
+version: v2.1.0
 description: "Join the instance to your Tailscale network (auto-mints a key from an OAuth client)"
 author: spore-host
 license: Apache-2.0
@@ -22,6 +22,21 @@ license: Apache-2.0
 # there is nothing to deprovision, and a stop/start needs no reconcile (Tailscale
 # is an overlay network — the node reconnects on boot regardless of public IP).
 
+# Declared capability surface (enforced at publish time by `spawn plugin validate
+# --strict`, surfaced by `spawn plugin inspect`).
+permissions:
+  controller:
+    network: true # mints an auth key via the Tailscale API
+    env:
+      - TS_API_CLIENT_ID
+      - TS_API_CLIENT_SECRET
+    commands:
+      - curl
+      - jq
+  instance:
+    root: true # install (curl|sh, systemctl) and `tailscale up` run as root
+    network: true # installs tailscaled and joins the tailnet
+
 config:
   tag:
     type: string