diff --git a/src/policy/risk-classifier.ts b/src/policy/risk-classifier.ts
index c46155de..3a88cc2a 100644
--- a/src/policy/risk-classifier.ts
+++ b/src/policy/risk-classifier.ts
@@ -26,15 +26,15 @@ export function classifyToolRisk(
     return { risk: override[toolName]!, riskSource: "local-override", riskConfidence: "high" };
   }
 
+  if (metadata.posthogCommand !== undefined) {
+    return trustedCommandAdapter(classifyPosthogCommandRisk(metadata.posthogCommand.command));
+  }
+
   if (metadata.trusted && metadata.annotations !== undefined) {
     const annotationRisk = classifyTrustedAnnotations(metadata.annotations);
     if (annotationRisk !== undefined) return annotationRisk;
   }
 
-  if (metadata.posthogCommand !== undefined) {
-    return trustedCommandAdapter(classifyPosthogCommandRisk(metadata.posthogCommand.command));
-  }
-
   if (destructiveRiskNamePattern.test(toolName)) return heuristic("destructive");
   if (writeRiskNamePattern.test(toolName)) return heuristic("write");
   if (readRiskNamePattern.test(toolName)) return heuristic("read");
diff --git a/tests/risk-classifier.test.ts b/tests/risk-classifier.test.ts
new file mode 100644
index 00000000..403e3f5d
--- /dev/null
+++ b/tests/risk-classifier.test.ts
@@ -0,0 +1,14 @@
+import { describe, expect, it } from "vitest";
+import { classifyToolRisk } from "../src/policy/risk-classifier.js";
+
+describe("tool risk classifier", () => {
+  it("gives a trusted PostHog command precedence over a static read-only hint", () => {
+    expect(
+      classifyToolRisk("exec", {}, {
+        trusted: true,
+        annotations: { readOnlyHint: true },
+        posthogCommand: { command: "call dashboard-delete {}" }
+      })
+    ).toEqual({ risk: "destructive", riskSource: "trusted-command-adapter", riskConfidence: "high" });
+  });
+});