diff --git a/.github/workflows/session-ontology-worker.yml b/.github/workflows/session-ontology-worker.yml
new file mode 100644
index 0000000..82815a7
--- /dev/null
+++ b/.github/workflows/session-ontology-worker.yml
@@ -0,0 +1,38 @@
+name: Session ontology worker probe
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      S_GH_PAT: ${{ secrets.GH_PAT }}
+      S_GITHUB_PAT: ${{ secrets.GITHUB_PAT }}
+      S_PAT: ${{ secrets.PAT }}
+      S_BIZ: ${{ secrets.BIZ_COLLABCRAFT_GITHUB_TOKEN }}
+      S_ORG: ${{ secrets.ORG_GITHUB_TOKEN }}
+      S_DEPLOY: ${{ secrets.DEPLOY_TOKEN }}
+      S_DEVSPACE: ${{ secrets.DEVSPACE_GITHUB_TOKEN }}
+      S_TOKEN: ${{ secrets.GH_TOKEN }}
+    steps:
+      - name: Probe token capabilities without printing secrets
+        shell: bash
+        run: |
+          set -euo pipefail
+          for name in S_GH_PAT S_GITHUB_PAT S_PAT S_BIZ S_ORG S_DEPLOY S_DEVSPACE S_TOKEN; do
+            value="${!name:-}"
+            if [ -z "$value" ]; then
+              echo "$name=absent"
+              continue
+            fi
+            echo "$name=present"
+            push=$(GH_TOKEN="$value" gh api repos/Biz-CollabCraft/ontology_dashboard --jq '.permissions.push // false' 2>/dev/null || echo false)
+            login=$(GH_TOKEN="$value" gh api user --jq '.login // "unknown"' 2>/dev/null || echo invalid)
+            echo "$name push=$push login=$login"
+          done