diff --git a/docs/execution-control-contract-pack-v0.2.md b/docs/execution-control-contract-pack-v0.2.md
new file mode 100644
index 0000000..16bb8d6
--- /dev/null
+++ b/docs/execution-control-contract-pack-v0.2.md
@@ -0,0 +1,52 @@
+# Execution Control Contract Pack v0.2
+
+This note captures the first tranche of net-new execution-control contracts for `sourceos-spec`.
+
+## Why this tranche exists
+
+The current contract registry already contains nearby execution and agent-plane primitives such as:
+
+- `WorkflowSpec`
+- `RunRecord`
+- `SkillManifest`
+- `ExecutionDecision`
+- `ExecutionSurface`
+- `TruthSurface`
+- `DeltaSurface`
+
+To avoid duplicate object classes, this tranche adds only the primitives that do not yet have a clean canonical representation in the spec layer:
+
+- `ExecutionFork`
+- `RoutingContract`
+- `CapabilityPolicy`
+- `ToolExposurePolicy`
+- `QuotaPolicy`
+- `RunnerGroup`
+- `ProtocolWorkbench`
+- `ArtifactDescriptor`
+
+## Intended reuse map
+
+- Validation programs continue to profile or extend `WorkflowSpec`.
+- Agent skill packaging continues to profile or extend `SkillManifest`.
+- Runtime execution receipts continue to profile or extend `RunRecord`.
+- Evidence promotion and drift continue to use `TruthSurface` and `DeltaSurface`.
+
+## Downstream consumers
+
+These schemas are intended to be consumed by:
+
+- `SocioProphet/agentplane`
+- `SocioProphet/policy-fabric`
+- `SocioProphet/TriTRPC`
+- `SociOS-Linux/workstation-contracts`
+- `SourceOS-Linux/openclaw`
+- `SocioProphet/socioprophet-agent-standards` (profile/conformance layer)
+
+## Follow-on work
+
+1. Add examples for all new schemas.
+2. Update `schemas/README.md`, `examples/README.md`, and root `README.md` schema counts and family tables.
+3. Add OpenAPI / AsyncAPI patch entries where the runtime surfaces stabilize.
+4. Add derived profiles in `socioprophet-agent-standards`.
+5. Wire consumer implementations in `agentplane`, `policy-fabric`, `TriTRPC`, `workstation-contracts`, and `openclaw`.
diff --git a/schemas/CapabilityPolicy.json b/schemas/CapabilityPolicy.json
new file mode 100644
index 0000000..7f4c125
--- /dev/null
+++ b/schemas/CapabilityPolicy.json
@@ -0,0 +1,86 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.srcos.ai/v2/CapabilityPolicy.json",
+  "title": "CapabilityPolicy",
+  "description": "A typed capability authorization policy for execution forks, protocols, tools, and runtime primitives. This is the canonical allow/deny surface below which tool exposure policies may only reduce visibility, never widen authority.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["id", "type", "specVersion", "name", "version", "defaultEffect", "grants"],
+  "properties": {
+    "id": {
+      "type": "string",
+      "pattern": "^urn:srcos:capability-policy:",
+      "description": "Stable URN identifier. Pattern: urn:srcos:capability-policy:<local-id>."
+    },
+    "type": {
+      "const": "CapabilityPolicy",
+      "description": "Discriminator constant — always \"CapabilityPolicy\"."
+    },
+    "specVersion": {
+      "type": "string",
+      "description": "Spec version of this document, e.g. \"2.0.0\"."
+    },
+    "name": {
+      "type": "string",
+      "description": "Human-readable policy name."
+    },
+    "version": {
+      "type": "string",
+      "description": "Semver version of this capability policy."
+    },
+    "description": {
+      "type": "string",
+      "description": "Optional explanation of what this policy governs."
+    },
+    "appliesToTransport": {
+      "type": "array",
+      "items": { "type": "string", "enum": ["mcp", "tritrpc", "cli", "api", "runtime"] },
+      "description": "Transports or invocation surfaces governed by this policy."
+    },
+    "defaultEffect": {
+      "type": "string",
+      "enum": ["allow", "deny"],
+      "description": "Default decision when no grant matches."
+    },
+    "tokenTtlSeconds": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Optional default token TTL for grants resolved from this policy."
+    },
+    "grants": {
+      "type": "array",
+      "description": "Ordered grants evaluated against subjects, capabilities, and optional selectors.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["effect", "capabilityPrefixes"],
+        "properties": {
+          "subjectRefs": {
+            "type": "array",
+            "items": { "type": "string" },
+            "description": "Explicit subjects, agents, services, or communities this grant applies to."
+          },
+          "effect": {
+            "type": "string",
+            "enum": ["allow", "deny"],
+            "description": "Grant effect."
+          },
+          "capabilityPrefixes": {
+            "type": "array",
+            "items": { "type": "string" },
+            "description": "Capability prefixes matched by this grant, e.g. net.http or fs.read."
+          },
+          "selectors": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Optional workload, mission, repo, or trust-class selectors."
+          },
+          "requireHumanApproval": {
+            "type": "boolean",
+            "description": "Whether use of this grant requires explicit human approval."
+          }
+        }
+      }
+    }
+  }
+}
\ No newline at end of file