diff --git a/agent.py b/agent.py
index 1f3d48a..cb8e9f9 100644
--- a/agent.py
+++ b/agent.py
@@ -516,7 +516,7 @@ class CustomerIntegrationEngineer(A2AAgent[CustomerIntegrationEngineerConfig, No
             blocked_actions=blocked_actions,
         )
 
-    @a2a.tool(description="Validate OpenAPI, JSON Schema, and webhook contracts with deterministic fixtures", timeout_seconds=120, idempotent=True, max_retries=0, cost_class="deterministic")
+    @a2a.tool(description="Validate OpenAPI, JSON Schema, and webhook contracts with deterministic fixtures", timeout_seconds=120, idempotent=True, max_retries=0, cost_class="deterministic", grant_outputs_prefix="outputs", grant_write_prefixes=("outputs/integrations",))
     async def validate_contract(self, ctx: RunContext[NoAuth], request: ValidateContractRequest) -> ValidateContractResult:
         dry_run = _effective_dry_run(self, request.dry_run)
         audit = [_audit("contract_validation_started", request.integration_id, {"contracts": len(request.contracts), "dry_run": dry_run})]