diff --git a/docs b/docs
index ab3cb38..5081401 160000
--- a/docs
+++ b/docs
@@ -1 +1 @@
-Subproject commit ab3cb38edafe1a394dabb32f6ec72589717adb4b
+Subproject commit 50814016a3a840f8fa034d209015b0f26969d957
diff --git a/internal/ai/application/runtime/einoexperiment/react_test.go b/internal/ai/application/runtime/einoexperiment/react_test.go
index 76348a9..8335773 100644
--- a/internal/ai/application/runtime/einoexperiment/react_test.go
+++ b/internal/ai/application/runtime/einoexperiment/react_test.go
@@ -65,7 +65,7 @@ func (e *fakeMCPToolExecutor) Execute(_ context.Context, toolCode string, argume
 	e.toolCode = toolCode
 	e.arguments = arguments
 	e.policy = policy
-	return aitooling.Definition{Code: toolCode, RiskLevel: aitooling.RiskLevelSensitive}, e.result, e.err
+	return aitooling.Definition{Code: toolCode, RiskLevel: aitooling.RiskLevelRead}, e.result, e.err
 }
 
 var _ model.ToolCallingChatModel = (*scriptedToolCallingModel)(nil)
diff --git a/internal/ai/tooling/registry.go b/internal/ai/tooling/registry.go
index 504c1f6..120e020 100644
--- a/internal/ai/tooling/registry.go
+++ b/internal/ai/tooling/registry.go
@@ -11,9 +11,8 @@ import (
 )
 
 const (
-	RiskLevelRead      = "read"
-	RiskLevelWrite     = "write"
-	RiskLevelSensitive = "sensitive"
+	RiskLevelRead  = "read"
+	RiskLevelWrite = "write"
 )
 
 // Definition is the normalized, engine-independent description of a tool.
diff --git a/internal/services/ai_agent_service.go b/internal/services/ai_agent_service.go
index ef7152d..484565d 100644
--- a/internal/services/ai_agent_service.go
+++ b/internal/services/ai_agent_service.go
@@ -248,7 +248,7 @@ func (s *aIAgentService) validatePublishableAgent(db *gorm.DB, agent *models.AIA
 			return errorsx.InvalidParam("ai agent direct tool definition is unavailable")
 		}
 		if definition.RequireConfirmation {
-			return errorsx.InvalidParam("ai agent sensitive direct tools must be executed through a confirmed playbook")
+			return errorsx.InvalidParam("ai agent direct tool requires confirmation and cannot be executed directly")
 		}
 	}
 	return nil
@@ -456,7 +456,7 @@ func (s *aIAgentService) normalizeToolPolicy(raw string) (string, error) {
 		if level == "" {
 			continue
 		}
-		if level != "read" && level != "write" && level != "sensitive" {
+		if level != "read" && level != "write" {
 			return "", errorsx.InvalidParam("ai agent tool policy contains an invalid risk level")
 		}
 		if _, exists := seen[level]; exists {
diff --git a/internal/services/ai_agent_workflow_service_test.go b/internal/services/ai_agent_workflow_service_test.go
index c8cb996..faac605 100644
--- a/internal/services/ai_agent_workflow_service_test.go
+++ b/internal/services/ai_agent_workflow_service_test.go
@@ -185,13 +185,16 @@ func TestAIAgentServiceCreatesWorkflowDraftForHybrid(t *testing.T) {
 }
 
 func TestAIAgentServiceNormalizesToolPolicy(t *testing.T) {
-	policy, err := AIAgentService.normalizeToolPolicy(`{"maxTotalCalls":2,"maxArgumentBytes":1024,"allowedRiskLevels":["READ","read","sensitive"]}`)
+	policy, err := AIAgentService.normalizeToolPolicy(`{"maxTotalCalls":2,"maxArgumentBytes":1024,"allowedRiskLevels":["READ","read","write"]}`)
 	if err != nil {
 		t.Fatalf("normalizeToolPolicy: %v", err)
 	}
-	if !strings.Contains(policy, `"maxTotalCalls":2`) || !strings.Contains(policy, `"allowedRiskLevels":["read","sensitive"]`) {
+	if !strings.Contains(policy, `"maxTotalCalls":2`) || !strings.Contains(policy, `"allowedRiskLevels":["read","write"]`) {
 		t.Fatalf("unexpected normalized policy: %s", policy)
 	}
+	if _, err := AIAgentService.normalizeToolPolicy(`{"allowedRiskLevels":["sensitive"]}`); err == nil {
+		t.Fatal("expected removed sensitive risk level to be rejected")
+	}
 	if _, err := AIAgentService.normalizeToolPolicy(`{"allowedRiskLevels":["admin"]}`); err == nil {
 		t.Fatal("expected invalid risk level error")
 	}