Record the caller permission boundary

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

docs/content/reference/process-workflow-fleet-standard.md

@@ -110,12 +110,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-permissions:
-  contents: write
-  pull-requests: write
-  statuses: write
-  pages: write
-  id-token: write
+permissions: {}
 
 jobs:
   Process-PSModule:
@@ -137,7 +132,7 @@ decisions before canonical guides, templates, or consumer workflows adopt it:
 | Trigger ownership | The caller owns manual, schedule, default-branch push, and pull-request triggers. | Move some trigger policy into separate workflows or omit selected event classes. |
 | Pull-request activities | Keep all six listed activity types. | Reduce the activity list if a v8 behavior is intentionally unsupported. |
 | Concurrency | Use the workflow plus PR-number-or-full-ref key and cancel only pull-request runs. | Selected for the candidate: PR reconciliation must be resumable; non-PR runs serialize by full ref. |
-| Permissions | Declare the five current scopes at workflow level. | Introduce settings-based least-privilege profiles or split read-only validation from release work. |
+| Permissions | Set caller permissions to `{}` and use scoped GitHub App tokens inside the reusable workflow. | Selected for the candidate; built-in `GITHUB_TOKEN` authority must not be required. |
 | Fork behavior | Skip fork-originated pull requests in this credentialed wrapper. | Add a separate secret-free workflow or define another supported fork-validation design. |
 | Credentials | Explicitly map the three v8 credentials. | Define a narrower credential profile for repositories that cannot publish. |
 | Optional surface | Permit only documented `TestData`, workflow inputs, schedule timing, and presentation metadata. | Allow additional extension points after naming and compatibility rules are agreed. |
@@ -172,7 +167,7 @@ fleet campaign. Branch names, `latest`, floating minor tags, and unqualified tar
 | Manual dispatch | Keep `workflow_dispatch`. | Provides the documented default-branch manual release and recovery path. |
 | Schedule | Keep a scheduled health run. | Exercises current dependencies even when repository code is unchanged. |
 | Concurrency | Use the PR-number-or-ref key and cancel only pull-request runs. | New PR events supersede older declarative reconciliation runs; same-ref push, dispatch, and schedule runs serialize without cancellation. |
-| Permissions | Declare the five documented permissions explicitly. | The called workflow cannot elevate caller permissions. |
+| Permissions | Set top-level `permissions: {}` and grant no caller-job permissions. | Repository access and mutations use narrowly scoped GitHub App installation tokens created inside the reusable workflow. |
 | Fork guard | Skip pull requests whose head repository differs from `github.repository`. | GitHub withholds the required repository secrets from fork pull requests. |
 | Reference | Use the intended internal floating major tag (`v8`) after tag governance is enforced. | Compatible owned releases roll out centrally; breaking releases require a new major and campaign. |
 | Credentials | Explicitly map the three required secrets. | Satisfies the `v7+` contract and prevents unrelated secret inheritance. |
@@ -205,7 +200,13 @@ an approved structure:
 - a concurrency key other than workflow plus PR number or full ref, or cancellation behavior other than pull-request-only;
 - trigger-level path filters that bypass Process-PSModule important-file evaluation;
 - unrelated additional jobs in the caller wrapper;
-- omitted documented permissions without a verified settings-based least-privilege profile.
+- any built-in `GITHUB_TOKEN` permission granted by the caller.
+
+The current v8 implementation still uses built-in token authority for checkout, linter status/reporting, and the standard
+GitHub Pages deployment action. Before adopting the empty-permissions caller, each job must create a narrowly scoped
+GitHub App installation token before checkout and pass it explicitly to checkout, GitHub CLI, and reporting actions.
+Pages publication must either move to an App-authenticated deployment path or document the unavoidable `pages`/OIDC
+exception if the standard Pages action remains.
 
 Fork-originated pull requests are skipped by the candidate caller because reusable-workflow caller jobs cannot select a
 GitHub Environment and repository secrets are unavailable to forks. Supporting fork CI requires a separate, secret-free,