diff --git a/prompts/08_tool-elevate.md b/prompts/08_tool-elevate.md
new file mode 100644
index 0000000..1c6e514
--- /dev/null
+++ b/prompts/08_tool-elevate.md
@@ -0,0 +1,17 @@
+# Elevation
+
+**Purpose**: run a bash command outside the sandbox with user approval, via the configured elevation backend (e.g. superpowers).
+
+**Trigger condition**: any time a task requires privileges unavailable inside the sandbox — installing packages, writing to protected paths, managing system services, etc.
+
+**Calling convention**:
+```
+execute_code: steps=[{code: "apt install -y ripgrep", elevated: true}]
+execute_code: steps=[{code: "systemctl restart nginx", elevated: true}]
+```
+
+**Constraints**:
+- `elevated: true` is a per-step flag — apply it only to steps that actually need it. Other steps in the same pipeline run normally inside the sandbox.
+- Only bash is supported for elevated steps.
+- The elevation backend must be available; if not, the step fails with "elevation not available". Do not assume elevation is always present.
+- Elevated steps require user approval from the elevation backend — they will block until approved or denied.