diff --git a/packages/business/README.md b/packages/business/README.md
index 9c3e8d1f4..ca372c5ed 100644
--- a/packages/business/README.md
+++ b/packages/business/README.md
@@ -34,7 +34,7 @@ in this repository, or `$MOSAIC_ROLES_DIR` if set.
   "network": "api-only",
   "authority": {
     "withinRole": ["task.update.assigned", "git.push.working", "review.request", "message.send"],
-    "crossRole": ["task.reassign", "task.scope.change"]
+    "crossRole": ["task.scope.change"]
   },
   "credentials": [
     { "service": "gitea", "scopes": ["write:issue", "write:repository", "read:user"] },
diff --git a/packages/harness/tests/tools.test.mjs b/packages/harness/tests/tools.test.mjs
index 31606131d..3fe7dd1e8 100644
--- a/packages/harness/tests/tools.test.mjs
+++ b/packages/harness/tests/tools.test.mjs
@@ -30,9 +30,7 @@ test("a coder gets no launch, no resolve_decision, and no task tools without a t
   const tools = typedTools({ resolved: coder });
   assert.deepEqual(names(tools), ["send_message", "raise_decision", "list_agents", "inbox", "trail"]);
   // Held actions without a tool are listed, so the manifest shows them.
-  const untyped = untypedActions(coder, tools);
-  assert.ok(untyped.includes("git.push.working"));
-  assert.ok(!untyped.includes("message.send"));
+  assert.deepEqual(untypedActions(coder, tools), ["task.update.assigned", "git.push.working", "review.request", "task.scope.change"]);
 });
 
 test("a coder with a tracker gets its own task tools and no task_reassign", (t) => {
diff --git a/packages/tasks/README.md b/packages/tasks/README.md
index 61b366647..d47f5de6e 100644
--- a/packages/tasks/README.md
+++ b/packages/tasks/README.md
@@ -190,10 +190,10 @@ Details that aren't obvious from the table:
 - `task.close` moves the task into the done bucket. `verdict` is a
   citation of the review verdict in the queue. The adapter records it
   and doesn't check it. Checking it against the queue is a follow-up.
-- A coder role's `crossRole` grant of `task.reassign` can't be used. The
-  writer check refuses it before authority is looked at. If a coder
-  should hand work on, that's a change to the field table, not to the
-  role file.
+- The coder role holds no `task.reassign` grant (row 73). The writer
+  check refuses a non-pm `task.reassign` before authority is looked at
+  anyway. If a coder should hand work on, that's a change to the field
+  table, not to the role file.
 
 Verbs for one business run one at a time, in the same queue as the poll,
 so a poll never reads between two writes of a verb.
diff --git a/packages/tasks/live/run.mjs b/packages/tasks/live/run.mjs
index eed1513e0..0c8d7e973 100644
--- a/packages/tasks/live/run.mjs
+++ b/packages/tasks/live/run.mjs
@@ -29,7 +29,7 @@ const AUTHORITY = {
     withinRole: ['task.create', 'task.assign', 'task.reassign', 'task.schedule', 'task.update.assigned', 'task.close', 'message.send'],
     crossRole: ['task.priority.change', 'task.scope.change'],
   },
-  coder: { withinRole: ['task.update.assigned', 'message.send'], crossRole: ['task.reassign', 'task.scope.change'] },
+  coder: { withinRole: ['task.update.assigned', 'git.push.working', 'review.request', 'message.send'], crossRole: ['task.scope.change'] },
   reviewer: { withinRole: ['task.update.assigned', 'message.send'], crossRole: [] },
 };
 const ref = (x) => (x.file ? { file: x.file, expires: x.expires } : { env: x.env, expires: x.expires });