diff --git a/src/api/permissions.js b/src/api/permissions.js
index d35525d..dc6c31a 100644
--- a/src/api/permissions.js
+++ b/src/api/permissions.js
@@ -56,6 +56,14 @@ export const ACTIVITY_ROLES = {
   'zk-act-realise':      ['ops_admin'],
   'zk-act-onboard':      ['ops_admin', 'ai_engage'],
   'zk-act-resume':       ['ops_admin', 'partner_agent', 'bank_rm', 'csr_direct'],
+
+  // The AI's one way of saying "a person should take this". Every employee
+  // holds it, and so does ops — a person can park a lead for the same reasons.
+  'zk-act-flag-review':  ['ops_admin', 'ai_intake', 'ai_engage', 'ai_kyc', 'ai_advisor', 'ai_uw_referral'],
+  // And the two ways back out of Needs a Person. The underwriter is here too:
+  // a flag they are sent is theirs to route, not only ops'.
+  'zk-act-review-resume':['ops_admin', 'sme_underwriter'],
+  'zk-act-review-refer': ['ops_admin', 'sme_underwriter'],
   'zk-act-drop':         ['ops_admin', 'partner_agent', 'bank_rm', 'csr_direct'],
 
   // ── The one place this mirror deliberately DISAGREES with the workflow ──