工具箱：权限矩阵、许可清单、视频权利表、成本算式Toolkit: rights and cost

模板内的比例、样本数、阈值和权限策略是示例。请按任务、授权与风险确定实际条件；填完表格不等于已经通过验收。

四个块用于采购评审与项目归档；括号里替换成你的项目值。

1. Agent 权限矩阵

| 操作             | 读 | 写 | 删除 | 需要确认 | 审计 |
|------------------|----|----|------|----------|------|
| 读仓库文件       | ✓  |    |      | 否       | 否   |
| 改代码           |    | ✓  |      | 是       | 是   |
| 跑测试           | ✓  |    |      | 否       | 是   |
| 装依赖           |    | ✓  |      | 是       | 是   |
| 推远端           |    | ✓  |      | 是       | 是   |
| 删文件           |    |    | ✓    | 是       | 是   |
| 读生产数据库     | ✓  |    |      | 是       | 是   |
| 改生产数据库     |    | ✓  |      | 双人复核 | 是   |

原则：默认只读；写操作逐条确认；删除与生产写操作双人复核。

2. 模型许可检查表

- [ ] 权重许可证（MIT / Apache-2.0 / CC-BY / 自定义）
- [ ] 是否允许商用
- [ ] 是否允许自托管
- [ ] 是否要求署名或继承许可
- [ ] 是否禁止用输出训练其他模型
- [ ] 是否有用户数/营收门槛
- [ ] 量化版是否沿用原模型许可
- [ ] 工具许可证与权重许可证分开核对
- [ ] 许可页 URL 与核验日期已存档

3. 视频权利登记表

| 素材 | 来源 | 许可 | 日期 | 证据 |
|------|------|------|------|------|
| 生成片段 | 模型名+版本 | 平台条款 | | 条款截图 |
| 音乐 | 曲库 | 曲库许可 | | 订单号 |
| 音效 | 曲库/自制 | | | |
| 字体 | 字体名 | 商用许可 | | 许可页 |
| 数字人 | 平台 | 肖像授权 | | 授权书 |
| 参考图 | 来源 | 授权 | | |

规则：没有证据的素材不入片；换素材要更新表。

4. 成本算式模板

一、模型调用
输入 tokens：____ × 单价 ____ = ____
输出 tokens：____ × 单价 ____ = ____

二、检索与工具
查询次数：____ × 单次成本 ____ = ____
工具调用：____ × 单次成本 ____ = ____

三、人力
标注：____ 小时 × 时薪 ____ = ____
复核：____ 小时 × 时薪 ____ = ____
维护：____ 小时/月 × 时薪 ____ = ____

四、本地部署（如适用）
硬件：____
电费：____ kWh/月 × 电价 ____ = ____
下载流量：____

合计：____ / 月
口径：单价写官方定价页日期；汇率写当日中间价。

Copy these four blocks for procurement and project records. Replace project fields. The permission matrix is an example risk policy, not a universal approval requirement.

1. Agent permissions

Operation | Example access | Approval | Record
Read repo files | Read | As authorized | As needed
Edit code | Write | As authorized | Yes
Run tests | Read/write test output | As authorized | Yes
Install dependencies | Write | Check project scope | Yes
Push remote | Write | Explicit authorization | Yes
Delete files | Delete | Appropriate authorization | Yes
Read production DB | Read | Restricted | Yes
Write production DB | Write | Higher-risk review | Yes

Use least privilege and define approval/recovery from actual risk and authority.

2. Model licensing

- [ ] Actual weight license: MIT/Apache-2.0/CC-BY/custom/etc.
- [ ] Commercial use and self-hosting
- [ ] Attribution and derivative obligations
- [ ] Restrictions on training other models with outputs
- [ ] User/revenue thresholds
- [ ] Terms inherited by quantized variants
- [ ] Tool license and weight license checked separately
- [ ] Source URL, version and checking date recorded

3. Video rights

Asset | Source | Permission | Date | Evidence
Generated clip | Model/version | Platform terms | | Saved terms
Music | Library | Track license | | Receipt
Sound effect | Library/self-created | | |
Font | Font name | Intended-use terms | | License
Digital likeness | Platform/person | Authorization | | Consent
Reference image | Origin | Permission | | Evidence

Resolve missing evidence before using an asset; update the record when replacing it.

4. Cost calculation

Model: input tokens × input rate + output tokens × output rate
Retrieval: queries × query rate
Tools: calls × applicable fee
Labor: labeling/review/maintenance hours × relevant rates
Local deployment if applicable: hardware, kWh × electricity rate, transfer
Total: [ ] per month

Record source dates for rates and the exchange-rate basis.

• 权限矩阵还应写明执行条件、确认方式和记录要求；只写“允许”不足以说明边界。
• 许可只看工具：权重许可才是商用与否的关键。
• 权利表事后补：素材来源记不清，只能重做。
• 成本还需纳入检索、复核与维护；各项占比取决于实际项目。

• “Allowed” alone leaves execution conditions and records unspecified.
• Check actual weight terms as well as tool licensing.
• Keep asset provenance while working; reconstructing it later is harder.
• Calculate retrieval, review and maintenance alongside tokens; their shares vary by project.