diff --git a/.planning/phases/02-permissions/02-VALIDATION.md b/.planning/phases/02-permissions/02-VALIDATION.md
new file mode 100644
index 0000000..cac0584
--- /dev/null
+++ b/.planning/phases/02-permissions/02-VALIDATION.md
@@ -0,0 +1,84 @@
+---
+phase: 2
+slug: permissions
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: 2026-04-02
+---
+
+# Phase 2 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | xUnit 2.9.3 |
+| **Config file** | none — runner picks up via `xunit.runner.visualstudio` |
+| **Quick run command** | `dotnet test SharepointToolbox.Tests\SharepointToolbox.Tests.csproj -x` |
+| **Full suite command** | `dotnet test SharepointToolbox.slnx` |
+| **Estimated runtime** | ~15 seconds |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** Run `dotnet test SharepointToolbox.Tests\SharepointToolbox.Tests.csproj -x`
+- **After every plan wave:** Run `dotnet test SharepointToolbox.slnx`
+- **Before `/gsd:verify-work`:** Full suite must be green
+- **Max feedback latency:** 15 seconds
+
+---
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|-----------|-------------------|-------------|--------|
+| 2-??-01 | Wave 0 | 0 | PERM-01, PERM-04 | unit | `dotnet test --filter "FullyQualifiedName~PermissionsServiceTests"` | ❌ W0 | ⬜ pending |
+| 2-??-02 | Wave 0 | 0 | PERM-02 | unit | `dotnet test --filter "FullyQualifiedName~PermissionsViewModelTests"` | ❌ W0 | ⬜ pending |
+| 2-??-03 | Wave 0 | 0 | PERM-03 | unit | `dotnet test --filter "FullyQualifiedName~PermissionEntryClassificationTests"` | ❌ W0 | ⬜ pending |
+| 2-??-04 | Wave 0 | 0 | PERM-05 | unit | `dotnet test --filter "FullyQualifiedName~CsvExportServiceTests"` | ❌ W0 | ⬜ pending |
+| 2-??-05 | Wave 0 | 0 | PERM-06 | unit | `dotnet test --filter "FullyQualifiedName~HtmlExportServiceTests"` | ❌ W0 | ⬜ pending |
+| 2-??-06 | Existing | 1 | PERM-07 | unit (existing) | `dotnet test --filter "FullyQualifiedName~SharePointPaginationHelperTests"` | ✅ Phase 1 | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `SharepointToolbox.Tests/Services/PermissionsServiceTests.cs` — stubs for PERM-01, PERM-04 (via mock `IPermissionsService` interface)
+- [ ] `SharepointToolbox.Tests/ViewModels/PermissionsViewModelTests.cs` — stubs for PERM-02 (multi-site loop)
+- [ ] `SharepointToolbox.Tests/Services/PermissionEntryClassificationTests.cs` — stubs for PERM-03 (external user, principal type classification)
+- [ ] `SharepointToolbox.Tests/Services/Export/CsvExportServiceTests.cs` — stubs for PERM-05
+- [ ] `SharepointToolbox.Tests/Services/Export/HtmlExportServiceTests.cs` — stubs for PERM-06
+- [ ] Interface `IPermissionsService` in main project — needed for ViewModel mocking
+
+*Note: CSOM live tests marked `[Trait("Category", "Integration")]` and skipped in automated suite — same pattern as Phase 1.*
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| HTML report is sortable, filterable, groupable by user in a browser | PERM-06 | Browser rendering, JS interaction cannot be automated without E2E framework | Open exported HTML in Edge/Chrome; verify sort on column headers, filter input, and group-by-user toggle |
+| Multi-site scan returns results from 2+ sites | PERM-02 | Requires live SharePoint admin tenant | Run multi-site scan on 2 test sites; verify rows from both URLs appear in results |
+| 5,000-item library returns complete results | PERM-07 | Requires large real library | Scan a library with >5,000 items; compare total count to SharePoint admin UI |
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 15s
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending