diff --git a/CLAUDE.md b/CLAUDE.md
index e368c38..72b4e92 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -60,6 +60,7 @@ Volledige MCP-tool documentatie: [docs/runbooks/mcp-integration.md](./docs/runbo
 - **Foutcodes:** 400 = parse-fout, 422 = Zod-validatie, 403 = demo-token
 - **Server/client grens:** `*-server.ts` bevat DB/node-only; nooit importeren in client component
 - **Worker/jobs:** `ClaudeJob` queue (`QUEUED → CLAIMED → RUNNING → DONE|FAILED|SKIPPED`); MCP-worker claimt via `wait_for_job` en sluit met `update_job_status` — zie [worker-idempotency.md](./docs/runbooks/worker-idempotency.md)
+- **Model/mode per ClaudeJob:** kind-default → product → job-snapshot → `task.requires_opus`. Resolver in `scrum4me-mcp/src/lib/job-config.ts` (en gespiegeld in `lib/job-config.ts`) — zie [job-model-selection.md](./docs/runbooks/job-model-selection.md)
 - **Deployment:** `npm run verify && npm run build` vóór elke PR. Selectieve deploy-controle (labels + path-filter): zie [docs/runbooks/deploy-control.md](./docs/runbooks/deploy-control.md)
 
 ---
@@ -96,6 +97,7 @@ Volledige MCP-tool documentatie: [docs/runbooks/mcp-integration.md](./docs/runbo
 | Realtime NOTIFY-payload | `docs/patterns/realtime-notify-payload.md` |
 | Story met UI-component | `docs/patterns/story-with-ui-component.md` |
 | Web Push | `docs/patterns/web-push.md` |
+| Job-config resolver (PBI-67) | `lib/job-config.ts` ↔ `scrum4me-mcp/src/lib/job-config.ts` |
 
 ---
 
diff --git a/__tests__/actions/ideas-crud.test.ts b/__tests__/actions/ideas-crud.test.ts
index 6c038fc..5f4889c 100644
--- a/__tests__/actions/ideas-crud.test.ts
+++ b/__tests__/actions/ideas-crud.test.ts
@@ -47,6 +47,10 @@ vi.mock('@/lib/prisma', () => ({
       findMany: vi.fn(),
       create: vi.fn(),
       count: vi.fn(),
+      findUnique: vi.fn().mockResolvedValue(null),
+    },
+    product: {
+      findUnique: vi.fn().mockResolvedValue(null),
     },
     $transaction: vi.fn(),
     $executeRaw: vi.fn().mockResolvedValue(0),
diff --git a/__tests__/actions/sprint-runs.test.ts b/__tests__/actions/sprint-runs.test.ts
index a939d6e..acf4396 100644
--- a/__tests__/actions/sprint-runs.test.ts
+++ b/__tests__/actions/sprint-runs.test.ts
@@ -30,6 +30,7 @@ vi.mock('@/lib/prisma', () => ({
     },
     task: {
       updateMany: vi.fn(),
+      findUnique: vi.fn().mockResolvedValue(null),
     },
     claudeQuestion: {
       findMany: vi.fn(),
@@ -38,6 +39,9 @@ vi.mock('@/lib/prisma', () => ({
       create: vi.fn(),
       updateMany: vi.fn(),
     },
+    product: {
+      findUnique: vi.fn().mockResolvedValue(null),
+    },
     $transaction: vi.fn(),
   },
 }))
diff --git a/actions/ideas.ts b/actions/ideas.ts
index 859457b..bb5269e 100644
--- a/actions/ideas.ts
+++ b/actions/ideas.ts
@@ -13,6 +13,7 @@ import { getIronSession } from 'iron-session'
 import { z } from 'zod'
 
 import { prisma } from '@/lib/prisma'
+import { getJobConfigSnapshot } from '@/lib/job-config-snapshot'
 import { SessionData, sessionOptions } from '@/lib/session'
 import { enforceUserRateLimit } from '@/lib/rate-limit'
 import { ideaCreateSchema, ideaUpdateSchema } from '@/lib/schemas/idea'
@@ -413,6 +414,8 @@ async function startIdeaJob(
     }
   }
 
+  const ideaSnapshot = await getJobConfigSnapshot({ kind, productId: idea.product_id! })
+
   // Atomic: create job + flip idea-status + log.
   const job = await prisma.$transaction(async (tx) => {
     const j = await tx.claudeJob.create({
@@ -422,6 +425,7 @@ async function startIdeaJob(
         idea_id: id,
         kind,
         status: 'QUEUED',
+        ...ideaSnapshot,
       },
       select: { id: true },
     })
diff --git a/actions/sprint-runs.ts b/actions/sprint-runs.ts
index 7b4b87a..a08118b 100644
--- a/actions/sprint-runs.ts
+++ b/actions/sprint-runs.ts
@@ -8,6 +8,7 @@ import { Prisma } from '@prisma/client'
 import { prisma } from '@/lib/prisma'
 import { SessionData, sessionOptions } from '@/lib/session'
 import { parsePauseContext } from '@/lib/pause-context'
+import { getJobConfigSnapshot } from '@/lib/job-config-snapshot'
 
 async function getSession() {
   return getIronSession<SessionData>(await cookies(), sessionOptions)
@@ -176,6 +177,10 @@ async function startSprintRunCore(
   // server-side bij claim aangemaakt zodat order/base_sha consistent zijn
   // met de worktree-state op claim-tijd.
   if (sprint.product.pr_strategy === 'SPRINT_BATCH') {
+    const sprintSnapshot = await getJobConfigSnapshot({
+      kind: 'SPRINT_IMPLEMENTATION',
+      productId: sprint.product_id,
+    })
     await tx.claudeJob.create({
       data: {
         user_id,
@@ -185,13 +190,20 @@ async function startSprintRunCore(
         sprint_run_id: sprintRun.id,
         kind: 'SPRINT_IMPLEMENTATION',
         status: 'QUEUED',
+        ...sprintSnapshot,
       },
     })
     return { ok: true, sprint_run_id: sprintRun.id, jobs_count: 1 }
   }
 
-  // STORY / SPRINT (per-task): bestaand pad.
+  // STORY / SPRINT (per-task): bestaand pad. Snapshot per task zodat
+  // task.requires_opus de cascade kan overrulen.
   for (const t of orderedTasks) {
+    const taskSnapshot = await getJobConfigSnapshot({
+      kind: 'TASK_IMPLEMENTATION',
+      productId: sprint.product_id,
+      taskId: t.id,
+    })
     await tx.claudeJob.create({
       data: {
         user_id,
@@ -200,6 +212,7 @@ async function startSprintRunCore(
         sprint_run_id: sprintRun.id,
         kind: 'TASK_IMPLEMENTATION',
         status: 'QUEUED',
+        ...taskSnapshot,
       },
     })
   }
@@ -360,6 +373,10 @@ export async function resumePausedSprintRunAction(
             started_at: new Date(),
           },
         })
+        const resumeSnapshot = await getJobConfigSnapshot({
+          kind: 'SPRINT_IMPLEMENTATION',
+          productId: sprintJob.product_id,
+        })
         await tx.claudeJob.create({
           data: {
             user_id: userId,
@@ -369,6 +386,7 @@ export async function resumePausedSprintRunAction(
             sprint_run_id: newRun.id,
             kind: 'SPRINT_IMPLEMENTATION',
             status: 'QUEUED',
+            ...resumeSnapshot,
           },
         })
         await tx.sprintRun.update({
diff --git a/actions/user-questions.ts b/actions/user-questions.ts
index 3a076fa..d43c6d7 100644
--- a/actions/user-questions.ts
+++ b/actions/user-questions.ts
@@ -9,6 +9,7 @@ import { prisma } from '@/lib/prisma'
 import { SessionData, sessionOptions } from '@/lib/session'
 import { enforceUserRateLimit } from '@/lib/rate-limit'
 import { ACTIVE_JOB_STATUSES } from '@/lib/job-status'
+import { getJobConfigSnapshot } from '@/lib/job-config-snapshot'
 
 async function getSession() {
   return getIronSession<SessionData>(await cookies(), sessionOptions)
@@ -56,6 +57,8 @@ export async function createUserQuestionAction(
   })
   if (existing) return { error: 'Er loopt al een actieve PLAN_CHAT voor dit idee', code: 409 }
 
+  const snapshot = await getJobConfigSnapshot({ kind: 'PLAN_CHAT', productId: idea.product_id })
+
   const [uq, job] = await prisma.$transaction([
     prisma.userQuestion.create({
       data: {
@@ -71,6 +74,7 @@ export async function createUserQuestionAction(
         idea_id:    parsed.data.ideaId,
         kind:       'PLAN_CHAT',
         status:     'QUEUED',
+        ...snapshot,
       },
     }),
   ])
diff --git a/app/(app)/admin/jobs/page.tsx b/app/(app)/admin/jobs/page.tsx
index 76d0825..8a3ba85 100644
--- a/app/(app)/admin/jobs/page.tsx
+++ b/app/(app)/admin/jobs/page.tsx
@@ -21,6 +21,10 @@ export default async function AdminJobsPage() {
       output_tokens: true,
       cache_read_tokens: true,
       cache_write_tokens: true,
+      actual_thinking_tokens: true,
+      requested_model: true,
+      requested_thinking_budget: true,
+      requested_permission_mode: true,
       user: { select: { username: true } },
       product: { select: { name: true } },
     },
@@ -36,7 +40,8 @@ export default async function AdminJobsPage() {
       (job.input_tokens ?? 0) * Number(p.input_price_per_1m) / 1_000_000 +
       (job.output_tokens ?? 0) * Number(p.output_price_per_1m) / 1_000_000 +
       (job.cache_read_tokens ?? 0) * Number(p.cache_read_price_per_1m) / 1_000_000 +
-      (job.cache_write_tokens ?? 0) * Number(p.cache_write_price_per_1m) / 1_000_000
+      (job.cache_write_tokens ?? 0) * Number(p.cache_write_price_per_1m) / 1_000_000 +
+      (job.actual_thinking_tokens ?? 0) * Number(p.input_price_per_1m) / 1_000_000
     return { ...job, cost_usd: cost }
   })
 
diff --git a/components/admin/jobs-table.tsx b/components/admin/jobs-table.tsx
index 3b1c312..cddf90b 100644
--- a/components/admin/jobs-table.tsx
+++ b/components/admin/jobs-table.tsx
@@ -24,6 +24,10 @@ type Job = {
   pr_url: string | null
   error: string | null
   model_id: string | null
+  actual_thinking_tokens: number | null
+  requested_model: string | null
+  requested_thinking_budget: number | null
+  requested_permission_mode: string | null
   cost_usd: number | null
 }
 
@@ -131,13 +135,24 @@ function CostRow({ job }: { job: Job }) {
   function handleCancel() { startTransition(() => cancelJobAction(job.id)) }
   function handleDelete() { startTransition(() => deleteJobAction(job.id)) }
   const costLabel = job.cost_usd != null ? `$${job.cost_usd.toFixed(4)}` : '—'
+  const thinkingLabel = job.actual_thinking_tokens != null ? job.actual_thinking_tokens.toLocaleString('nl-NL') : '—'
+  const modelMismatch = job.requested_model != null && job.model_id != null && job.requested_model !== job.model_id
+  const modelTitle = job.requested_model
+    ? `Aangevraagd: ${job.requested_model}${modelMismatch ? ' (mismatch met actueel)' : ''}`
+    : undefined
   return (
     <TableRow>
       <TableCell className="font-mono text-xs text-muted-foreground">{job.id.slice(0, 8)}</TableCell>
       <TableCell className="text-sm">{job.user.username}</TableCell>
       <TableCell className="text-sm">{job.product.name}</TableCell>
       <TableCell className="text-xs">{KIND_LABEL[job.kind] ?? job.kind}</TableCell>
-      <TableCell className="text-xs text-muted-foreground">{job.model_id ?? '—'}</TableCell>
+      <TableCell
+        className={`text-xs ${modelMismatch ? 'text-priority-high font-medium' : 'text-muted-foreground'}`}
+        title={modelTitle}
+      >
+        {job.model_id ?? '—'}
+      </TableCell>
+      <TableCell className="text-xs font-mono text-muted-foreground">{thinkingLabel}</TableCell>
       <TableCell className="text-xs font-mono">{costLabel}</TableCell>
       <TableCell className="text-xs text-muted-foreground">
         {new Date(job.created_at).toLocaleString('nl-NL', { dateStyle: 'short', timeStyle: 'short' })}
@@ -164,6 +179,7 @@ function CostsTable({ jobs }: { jobs: Job[] }) {
           <TableHead>Product</TableHead>
           <TableHead>Type</TableHead>
           <TableHead>Model</TableHead>
+          <TableHead>Thinking</TableHead>
           <TableHead>Kosten (USD)</TableHead>
           <TableHead>Aangemaakt</TableHead>
           <TableHead className="text-right">Acties</TableHead>
@@ -172,7 +188,7 @@ function CostsTable({ jobs }: { jobs: Job[] }) {
       <TableBody>
         {jobs.length === 0 && (
           <TableRow>
-            <TableCell colSpan={8} className="text-center text-muted-foreground py-8">
+            <TableCell colSpan={9} className="text-center text-muted-foreground py-8">
               Geen jobs gevonden
             </TableCell>
           </TableRow>
diff --git a/docs/INDEX.md b/docs/INDEX.md
index 38eaa23..54a1e1e 100644
--- a/docs/INDEX.md
+++ b/docs/INDEX.md
@@ -42,6 +42,7 @@ Auto-generated on 2026-05-08 from front-matter and headings.
 | [Plan — Auto-PR + selectieve deploy-controle + sync-zicht (end-to-end batch flow)](./plans/auto-pr-deploy-sync.md) | — | — |
 | [Docs-restructuur — geoptimaliseerd voor AI-lookup](./plans/docs-restructure-ai-lookup.md) | proposal | 2026-05-02 |
 | [PBI Bulk-Create Spec — Docs-Restructure for AI-Optimized Lookup](./plans/docs-restructure-pbi-spec.md) | done | 2026-05-03 |
+| [Plan: model + mode-selectie per ClaudeJob-kind](./plans/job-model-selection.md) | — | — |
 | [Landing v2 — lokaal & veilig + architectuurdiagram](./plans/landing-local-first.md) | active | 2026-05-03 |
 | [Landing v3 — van idee tot pull request](./plans/landing-v3-idea-flow.md) | active | 2026-05-04 |
 | [M10 — Password-loze inlog via QR-pairing](./plans/M10-qr-pairing-login.md) | active | 2026-05-03 |
@@ -126,6 +127,7 @@ Auto-generated on 2026-05-08 from front-matter and headings.
 | [Branch, PR & Commit Strategy](./runbooks/branch-and-commit.md) | `runbooks/branch-and-commit.md` | active | 2026-05-03 |
 | [Deploy-controle: triggers, labels, path-filter](./runbooks/deploy-control.md) | `runbooks/deploy-control.md` | active | 2026-05-07 |
 | [Vercel Deployment](./runbooks/deploy-vercel.md) | `runbooks/deploy-vercel.md` | active | 2026-05-03 |
+| [Job-model-selectie per ClaudeJob-kind](./runbooks/job-model-selection.md) | `runbooks/job-model-selection.md` | active | 2026-05-08 |
 | [MCP Integration — Scrum4Me Tools](./runbooks/mcp-integration.md) | `runbooks/mcp-integration.md` | active | 2026-05-08 |
 | [v1.0 Smoke Test Checklist](./runbooks/v1-smoke-test.md) | `runbooks/v1-smoke-test.md` | active | 2026-05-04 |
 | [Worker idempotency & job-status protocol](./runbooks/worker-idempotency.md) | `runbooks/worker-idempotency.md` | active | 2026-05-05 |
diff --git a/docs/plans/job-model-selection.md b/docs/plans/job-model-selection.md
new file mode 100644
index 0000000..e6786d9
--- /dev/null
+++ b/docs/plans/job-model-selection.md
@@ -0,0 +1,152 @@
+# Plan: model + mode-selectie per ClaudeJob-kind
+
+## Context
+
+`ClaudeJob` heeft 5 kinds (`TASK_IMPLEMENTATION`, `IDEA_GRILL`, `IDEA_MAKE_PLAN`, `PLAN_CHAT`, `SPRINT_IMPLEMENTATION`) maar er is **geen per-kind model-/mode-configuratie**. Alle jobs draaien op de Claude Code CLI default. `ClaudeJob.model_id` ([prisma/schema.prisma](../../prisma/schema.prisma)) wordt alleen post-hoc gevuld voor kostenberekening via [lib/insights/token-stats.ts](../../lib/insights/token-stats.ts) en `model_prices` (PBI-66).
+
+Probleem: een grill-sessie verdient meer thinking-budget en geen file-edits, terwijl een task-implementation acceptEdits/bypassPermissions in een worktree wil. Nu is dat allemaal hetzelfde — wat leidt tot:
+
+- Te dure runs (Opus voor triviale Haiku-waardige taken)
+- Te schrale runs (Sonnet zonder thinking voor architectuurkeuze in `IDEA_MAKE_PLAN`)
+- Geen cost-attribution per kind voor budgettering
+- Geen product-level override voor klanten met eigen model-voorkeur
+
+**Doel:** een resolver die per `ClaudeJob` bepaalt: model, thinking-budget, permission-mode, max_turns, allowed_tools — gebaseerd op kind-defaults met overrides per product en per job. De worker geeft de geresolveerde config door aan Claude Code via CLI-flags.
+
+**Niet-doel:** de runtime vervangen door de Claude Agent SDK. Worker blijft Claude Code CLI; we bouwen erbovenop.
+
+## Aanpak
+
+### 1. Datamodel-uitbreiding
+
+| Tabel | Veld | Type | Doel |
+|---|---|---|---|
+| `Product` | `preferred_model` | `String?` | Product-brede default (bv. "alle taken op Sonnet voor budget") |
+| `Product` | `thinking_budget_default` | `Int?` | Idem voor thinking |
+| `Task` | `requires_opus` | `Boolean @default(false)` | Per-task escalatie (cross-file refactor) |
+| `ClaudeJob` | `requested_model` | `String?` | Snapshot van resolved model (audit) |
+| `ClaudeJob` | `requested_thinking_budget` | `Int?` | Snapshot van resolved budget |
+| `ClaudeJob` | `requested_permission_mode` | `String?` | Snapshot van resolved mode |
+| `ClaudeJob` | `actual_thinking_tokens` | `Int?` | Werkelijk verbruikte thinking-tokens (cost-attribution) |
+
+Migration is additief. Bestaande rijen krijgen `NULL` → resolver valt terug op kind-defaults.
+
+### 2. Centrale resolver
+
+**Locatie:** `scrum4me-mcp/src/lib/job-config.ts` (nieuw bestand in MCP-repo).
+
+```ts
+type JobConfig = {
+  model: 'claude-opus-4-7' | 'claude-sonnet-4-6' | 'claude-haiku-4-5-20251001'
+  thinking_budget: number  // 0 = uit
+  permission_mode: 'plan' | 'default' | 'acceptEdits' | 'bypassPermissions'
+  max_turns: number | null  // null = onbegrensd
+  allowed_tools: string[] | null  // null = alle
+}
+
+function resolveJobConfig(job: ClaudeJob, product: Product, task?: Task): JobConfig
+```
+
+**Resolutie-volgorde** (eerste match wint):
+1. `task.requires_opus === true` → forceer model = `claude-opus-4-7`
+2. `job.requested_*` (al ingevuld door enqueue-laag)
+3. `product.preferred_*`
+4. **Kind-default** uit deze tabel:
+
+| Kind | Model | Thinking | Permission | max_turns | allowed_tools |
+|---|---|---|---|---|---|
+| `IDEA_GRILL` | sonnet-4-6 | 12000 | `plan` | 15 | Read, Grep, Glob, WebSearch, AskUserQuestion |
+| `IDEA_MAKE_PLAN` | opus-4-7 | 24000 | `plan` | 20 | Read, Grep, Glob, WebSearch, AskUserQuestion, Write |
+| `PLAN_CHAT` | sonnet-4-6 | 6000 | `plan` | 5 | Read, Grep, AskUserQuestion |
+| `TASK_IMPLEMENTATION` | sonnet-4-6 | 6000 | `bypassPermissions` | 50 | null |
+| `SPRINT_IMPLEMENTATION` | sonnet-4-6 | 6000 | `bypassPermissions` | null | null |
+
+`bypassPermissions` is verdedigbaar omdat task/sprint-implementatie altijd in een geïsoleerde git-worktree draait (zie [docs/runbooks/branch-and-commit.md](../runbooks/branch-and-commit.md)). Voor productie-omgevingen kan `Product.preferred_permission_mode = 'acceptEdits'` als opt-in.
+
+### 3. `wait_for_job` response uitbreiden
+
+Huidig: `wait_for_job` returnt `{ job_id, kind, context }`. Toevoegen: `config: JobConfig`.
+
+Worker leest `config` en spawnt Claude Code subprocess met:
+```
+claude --model {config.model} \
+       --permission-mode {config.permission_mode} \
+       --thinking-budget {config.thinking_budget} \
+       [--max-turns {config.max_turns}] \
+       [--allowed-tools "{config.allowed_tools.join(',')}"]
+```
+
+Documentatie van vlaggen verwijst naar [Claude Code model-config](https://code.claude.com/docs/en/model-config). Als een vlag (nog) niet bestaat in de huidige CLI: skippen + log-warning, niet hardcrashen.
+
+### 4. Audit + cost-attribution
+
+Bij job-completion (in `update_job_status` MCP-tool):
+- `actual_thinking_tokens` schrijven naar `ClaudeJob` (al beschikbaar in Claude Code result-payload)
+- Bestaande `model_id`-update behouden (cost-berekening via `model_prices`)
+
+Token-stats-laag ([lib/insights/token-stats.ts](../../lib/insights/token-stats.ts)) uitbreiden:
+- Aggregeren per kind (nu per dag/product) — feature-gate tot ST-N nodig
+- Thinking-tokens apart tonen (andere prijs dan output-tokens)
+
+### 5. Documentatie
+
+- **Nieuw:** [docs/runbooks/job-model-selection.md](../runbooks/job-model-selection.md) — de matrix + wanneer je override gebruikt
+- **CLAUDE.md** Hardstop-bullet: "Model/mode per ClaudeJob: kind-default → product → task — zie runbook"
+- **Patterns quickref** in CLAUDE.md: regel toevoegen voor `job-config.ts` resolver-pattern
+
+## Voorgestelde PBI/story-breakdown
+
+Voor de Scrum4Me-MCP `create_pbi` / `create_story` / `create_task` ronde na goedkeuring:
+
+**PBI:** "Model + mode-selectie per ClaudeJob-kind"
+
+| Story | Doel | Tasks (indicatief) |
+|---|---|---|
+| **ST-1: Datamodel + migration** | Velden op Product/Task/ClaudeJob | Schema wijzigen · migration · Prisma generate · seed/factories updaten |
+| **ST-2: Resolver in scrum4me-mcp** | `job-config.ts` met kind-defaults + override-cascade | Resolver-functie · unit tests per kind · export voor MCP-tools |
+| **ST-3: `wait_for_job` integratie** | Config in response + snapshot in `requested_*` | Tool-output uitbreiden · enqueue-laag snapshot · worker-flag-passing documenteren |
+| **ST-4: Audit + cost-attribution** | `actual_thinking_tokens` opslaan + tonen | `update_job_status` uitbreiden · token-stats per kind · admin/jobs UI-kolom |
+| **ST-5: Documentatie** | Runbook + CLAUDE.md updates | runbook schrijven · CLAUDE.md hardstop · patterns-row |
+
+ST-1 → ST-2 → ST-3 zijn de kritieke pad-stories. ST-4 en ST-5 kunnen parallel met ST-3.
+
+## Bestanden
+
+| Bestand | Repo | Actie |
+|---|---|---|
+| `prisma/schema.prisma` | scrum4me | **Wijzigen** — 7 nieuwe velden |
+| `prisma/migrations/<ts>_job_model_selection/` | scrum4me | **Nieuw** — additive migration |
+| `scrum4me-mcp/src/lib/job-config.ts` | scrum4me-mcp | **Nieuw** — resolver |
+| `scrum4me-mcp/src/lib/job-config.test.ts` | scrum4me-mcp | **Nieuw** — unit tests per kind |
+| `scrum4me-mcp/src/tools/wait-for-job.ts` | scrum4me-mcp | **Wijzigen** — config in response |
+| `scrum4me-mcp/src/tools/update-job-status.ts` | scrum4me-mcp | **Wijzigen** — `actual_thinking_tokens` |
+| `lib/insights/token-stats.ts` | scrum4me | **Wijzigen** — per-kind aggregatie + thinking-prijs |
+| `actions/admin/jobs.ts` + UI-kolom | scrum4me | **Wijzigen** — model/mode tonen |
+| `docs/runbooks/job-model-selection.md` | scrum4me | **Nieuw** — runbook |
+| `CLAUDE.md` | scrum4me | **Wijzigen** — hardstop-bullet + patterns-row |
+
+## Verificatie
+
+Per story:
+- **ST-1:** `npm run verify` slaagt na schema-wijziging; migration runt clean op test-DB
+- **ST-2:** unit tests dekken alle 5 kinds × 4 cascade-niveaus (default/product/job/task)
+- **ST-3:** integratietest: enqueue een `IDEA_GRILL` met product-override → `wait_for_job` returnt config met override toegepast
+- **ST-4:** end-to-end: run een dummy-job, verifieer dat `actual_thinking_tokens` ingevuld wordt en dat token-stats het kostbedrag correct rekent (input + output + thinking-input rate)
+- **ST-5:** `npm run docs:check-links` groen; CLAUDE.md ≤ 150 regels
+
+End-to-end-validatie van het geheel:
+1. Maak een nieuw idee → `IDEA_GRILL`-job → controleer dat de worker met `--permission-mode plan` en `--thinking-budget 12000` start
+2. Approve het idee → `IDEA_MAKE_PLAN`-job → controleer Opus-aanroep met thinking 24000
+3. Sprint starten → `SPRINT_IMPLEMENTATION` met `bypassPermissions` in worktree
+4. Admin-jobs-pagina toont per job het gebruikte model + thinking-tokens
+
+## Vastgelegde beslissingen (review-uitkomst)
+
+1. **`bypassPermissions` als default voor implement-kinds** (TASK_IMPLEMENTATION, SPRINT_IMPLEMENTATION). Verdedigbaar door git-worktree-isolatie. `Product.preferred_permission_mode` blijft beschikbaar als opt-in voor productie-product
+2. **Opus-cost-controle = per-task** via `Task.requires_opus`-flag. Géén product-budget, géén automatische Opus-escalatie. Ad-hoc beslissing per taak
+3. **`PLAN_CHAT` runtime bevestigd: Claude Code CLI** — `wait_for_job` (`scrum4me-mcp/src/tools/wait-for-job.ts:386`) selecteert `IDEA_GRILL`, `IDEA_MAKE_PLAN` én `PLAN_CHAT` uit dezelfde queue. Resolver past 1:1, geen aparte runtime-route
+4. **`wait_for_job`-response: pure additief** (geen `protocol_version`-veld). Worker negeert onbekende velden veilig; mismatch is operationeel zichtbaar via `model_id` in token-stats. Geen multi-tenant fleet → geen versioning-overhead nodig
+
+---
+
+Bij goedkeuring: PBI + 5 stories + ~20 tasks aanmaken via `mcp__scrum4me__create_pbi/story/task`. Volgorde: ST-1 → ST-2 → ST-3 → (ST-4 ‖ ST-5).
diff --git a/docs/runbooks/job-model-selection.md b/docs/runbooks/job-model-selection.md
new file mode 100644
index 0000000..aa67480
--- /dev/null
+++ b/docs/runbooks/job-model-selection.md
@@ -0,0 +1,107 @@
+---
+title: "Job-model-selectie per ClaudeJob-kind"
+status: active
+audience: [ai-agent, contributor]
+language: nl
+last_updated: 2026-05-08
+when_to_read: "Vóór het wijzigen van model/thinking/permission-mode-keuze of bij debugging van 'verkeerd model gebruikt'-incidents."
+---
+
+# Job-model-selectie per ClaudeJob-kind
+
+PBI-67. Per `ClaudeJob.kind` bepaalt de Scrum4Me-mcp resolver
+`scrum4me-mcp/src/lib/job-config.ts` welk Claude-model + thinking-
+budget + permission-mode + max_turns + allowed_tools de Claude Code-
+worker moet gebruiken.
+
+Dezelfde resolver staat — als één-op-één spiegel — in
+[`lib/job-config.ts`](../../lib/job-config.ts) voor de enqueue-laag,
+zodat we bij job-creatie het resolved resultaat al snapshotten in
+`ClaudeJob.requested_*`.
+
+---
+
+## Override-cascade
+
+```
+   1. Task.requires_opus = true   →  forceer claude-opus-4-7
+   2. Job.requested_*             →  snapshot bij enqueue
+   3. Product.preferred_*         →  product-brede default
+   4. KIND_DEFAULTS               →  per kind onderstaand
+```
+
+**Eerste match wint.** `max_turns` en `allowed_tools` blijven in V1
+altijd kind-default — geen product- of task-override.
+
+---
+
+## Kind-default-matrix
+
+| Kind | Model | Thinking-budget | Permission-mode | max_turns | allowed_tools |
+|---|---|---|---|---|---|
+| `IDEA_GRILL` | `claude-sonnet-4-6` | 12 000 | `plan` | 15 | Read, Grep, Glob, WebSearch, AskUserQuestion |
+| `IDEA_MAKE_PLAN` | `claude-opus-4-7` | 24 000 | `plan` | 20 | Read, Grep, Glob, WebSearch, AskUserQuestion, Write |
+| `PLAN_CHAT` | `claude-sonnet-4-6` | 6 000 | `plan` | 5 | Read, Grep, AskUserQuestion |
+| `TASK_IMPLEMENTATION` | `claude-sonnet-4-6` | 6 000 | `bypassPermissions` | 50 | (alle) |
+| `SPRINT_IMPLEMENTATION` | `claude-sonnet-4-6` | 6 000 | `bypassPermissions` | (geen) | (alle) |
+
+**`bypassPermissions`** is verdedigbaar voor de implement-kinds omdat
+elke run in een geïsoleerde git-worktree start (zie
+[branch-and-commit.md](./branch-and-commit.md)). Productie-product?
+Zet `Product.preferred_permission_mode = 'acceptEdits'`.
+
+---
+
+## Wanneer overrul je een default?
+
+| Scenario | Wijzig op | Voorbeeld |
+|---|---|---|
+| Cross-file refactor of architectuurkeuze in TASK_IMPLEMENTATION | `Task.requires_opus = true` | Een PBI met "rip out auth middleware" |
+| Klant wil budget-control op een product | `Product.preferred_model = claude-sonnet-4-6` | Side-product met Haiku-only-budget |
+| Productie-product zonder bypassPermissions | `Product.preferred_permission_mode = 'acceptEdits'` | Klant-facing repo waar elke wijziging review nodig heeft |
+| Ad-hoc: Opus voor één specifieke story-job | `ClaudeJob.requested_model = claude-opus-4-7` (handmatige UPDATE) | Nood-debug van prod-incident |
+| Geen thinking voor een PLAN_CHAT (snelle reactie) | `Product.thinking_budget_default = 0` (alle kinds in dat product) | Demo-product |
+
+---
+
+## Auditspoor
+
+| Kolom | Wat | Wanneer ingevuld |
+|---|---|---|
+| `requested_model` | Resolved model op enqueue-tijd | `actions/*` enqueue-laag via `lib/job-config-snapshot.ts` |
+| `requested_thinking_budget` | Resolved budget op enqueue-tijd | idem |
+| `requested_permission_mode` | Resolved permission-mode | idem |
+| `model_id` | Werkelijk gebruikt model | `update_job_status` na worker-run |
+| `actual_thinking_tokens` | Werkelijk verbruikte thinking-tokens | idem |
+
+Verschillen tussen `requested_model` en `model_id` zijn zichtbaar in
+**admin → Jobs → Kosten** (rood-gemarkeerd modelveld + tooltip).
+Meestal duidt dat op een worker die de CLI-flag niet doorgaf —
+controleer de worker-script tegen de flag-tabel in
+[worker-idempotency.md](./worker-idempotency.md#config-doorgeven-aan-claude-code-pbi-67).
+
+---
+
+## Cost-attribution
+
+Thinking-tokens worden bij Anthropic-billing gerekend tegen de
+input-rate van het model. `lib/insights/token-stats.ts` en
+`lib/insights/token-history.ts` doen hetzelfde:
+
+```sql
+COALESCE(cj.actual_thinking_tokens, 0) * mp.input_price_per_1m / 1000000.0
+```
+
+Voor per-kind aggregatie binnen een sprint: gebruik
+`getTokenStatsByKind(userId, sprintId)`.
+
+---
+
+## Referenties
+
+- Plan: [docs/plans/job-model-selection.md](../plans/job-model-selection.md)
+- Resolver (MCP): `scrum4me-mcp/src/lib/job-config.ts`
+- Resolver (main): `lib/job-config.ts`
+- Snapshot-helper: `lib/job-config-snapshot.ts`
+- Worker-flag-mapping: [worker-idempotency.md](./worker-idempotency.md#config-doorgeven-aan-claude-code-pbi-67)
+- Schema: `prisma/schema.prisma` → `Product`, `Task`, `ClaudeJob` velden uit migration `20260508085909_add_job_model_selection_fields`
diff --git a/docs/runbooks/worker-idempotency.md b/docs/runbooks/worker-idempotency.md
index 38e023b..aab7578 100644
--- a/docs/runbooks/worker-idempotency.md
+++ b/docs/runbooks/worker-idempotency.md
@@ -110,6 +110,49 @@ Drie protocol-overtredingen die we met deze runbook + de nieuwe
 
 ---
 
+## Config doorgeven aan Claude Code (PBI-67)
+
+`wait_for_job` levert sinds PBI-67 een `config`-object mee in de
+response. Geef deze door aan `claude` als CLI-flags:
+
+```bash
+claude \
+  --model "$MODEL" \
+  --permission-mode "$PERMISSION_MODE" \
+  --thinking-budget "$THINKING_BUDGET" \
+  ${MAX_TURNS:+--max-turns $MAX_TURNS} \
+  ${ALLOWED_TOOLS:+--allowed-tools "$ALLOWED_TOOLS"}
+```
+
+Waar:
+
+| Variabele | Bron in response | Voorbeeld |
+|---|---|---|
+| `MODEL` | `config.model` | `claude-sonnet-4-6` |
+| `PERMISSION_MODE` | `config.permission_mode` | `bypassPermissions` |
+| `THINKING_BUDGET` | `config.thinking_budget` (0 = uit) | `12000` |
+| `MAX_TURNS` | `config.max_turns` (null = onbegrensd) | `15` of leeg |
+| `ALLOWED_TOOLS` | `config.allowed_tools.join(',')` (null = alle) | `Read,Grep,WebSearch` |
+
+Verwachte CLI-aanroep per kind (kind-defaults zonder overrides):
+
+| Kind | Model | thinking | permission_mode | max_turns |
+|---|---|---|---|---|
+| `IDEA_GRILL` | sonnet-4-6 | 12000 | plan | 15 |
+| `IDEA_MAKE_PLAN` | opus-4-7 | 24000 | plan | 20 |
+| `PLAN_CHAT` | sonnet-4-6 | 6000 | plan | 5 |
+| `TASK_IMPLEMENTATION` | sonnet-4-6 | 6000 | bypassPermissions | 50 |
+| `SPRINT_IMPLEMENTATION` | sonnet-4-6 | 6000 | bypassPermissions | (geen) |
+
+**Onbekende flag:** als de huidige Claude Code-versie een vlag niet
+kent, log een waarschuwing en sla 'm over — geen hard error. De server
+blijft jobs queuen.
+
+Volledige resolver-uitleg + override-cascade staat in
+[job-model-selection.md](./job-model-selection.md).
+
+---
+
 ## Referenties
 
 - Enum: `prisma/schema.prisma` → `enum ClaudeJobStatus`
@@ -119,4 +162,5 @@ Drie protocol-overtredingen die we met deze runbook + de nieuwe
 - KPI-aggregatie: `lib/insights/agent-throughput.ts` (terminal_7d
   inclusief SKIPPED)
 - Gerelateerd plan: `docs/plans/auto-pr-deploy-sync.md` Deel D
+- PBI-67 resolver: `scrum4me-mcp/src/lib/job-config.ts` + `lib/job-config.ts`
   (Sync-tab toont per-Story job-status incl. SKIPPED)
diff --git a/lib/insights/token-history.ts b/lib/insights/token-history.ts
index 75674b0..42f4ecc 100644
--- a/lib/insights/token-history.ts
+++ b/lib/insights/token-history.ts
@@ -57,12 +57,13 @@ export async function getSprintTokenHistory(
           sp.id AS sprint_id,
           sp.code AS sprint_code,
           sp.sprint_goal,
-          COALESCE(SUM(cj.input_tokens + cj.output_tokens + cj.cache_read_tokens + cj.cache_write_tokens), 0) AS total_tokens,
+          COALESCE(SUM(cj.input_tokens + cj.output_tokens + cj.cache_read_tokens + cj.cache_write_tokens + COALESCE(cj.actual_thinking_tokens, 0)), 0) AS total_tokens,
           SUM(
             cj.input_tokens  * mp.input_price_per_1m  / 1000000.0
             + cj.output_tokens * mp.output_price_per_1m / 1000000.0
             + cj.cache_read_tokens  * mp.cache_read_price_per_1m  / 1000000.0
             + cj.cache_write_tokens * mp.cache_write_price_per_1m / 1000000.0
+            + COALESCE(cj.actual_thinking_tokens, 0) * mp.input_price_per_1m / 1000000.0
           ) FILTER (WHERE cj.input_tokens IS NOT NULL) AS total_cost,
           COUNT(*) FILTER (WHERE cj.input_tokens IS NOT NULL) AS job_count
         FROM claude_jobs cj
@@ -82,12 +83,13 @@ export async function getSprintTokenHistory(
           sp.id AS sprint_id,
           sp.code AS sprint_code,
           sp.sprint_goal,
-          COALESCE(SUM(cj.input_tokens + cj.output_tokens + cj.cache_read_tokens + cj.cache_write_tokens), 0) AS total_tokens,
+          COALESCE(SUM(cj.input_tokens + cj.output_tokens + cj.cache_read_tokens + cj.cache_write_tokens + COALESCE(cj.actual_thinking_tokens, 0)), 0) AS total_tokens,
           SUM(
             cj.input_tokens  * mp.input_price_per_1m  / 1000000.0
             + cj.output_tokens * mp.output_price_per_1m / 1000000.0
             + cj.cache_read_tokens  * mp.cache_read_price_per_1m  / 1000000.0
             + cj.cache_write_tokens * mp.cache_write_price_per_1m / 1000000.0
+            + COALESCE(cj.actual_thinking_tokens, 0) * mp.input_price_per_1m / 1000000.0
           ) FILTER (WHERE cj.input_tokens IS NOT NULL) AS total_cost,
           COUNT(*) FILTER (WHERE cj.input_tokens IS NOT NULL) AS job_count
         FROM claude_jobs cj
@@ -118,12 +120,13 @@ export async function getDayTokenData(userId: string, sprintId: string): Promise
   const rows = await prisma.$queryRaw<RawDayRow[]>`
     SELECT
       DATE(cj.finished_at) AS day,
-      COALESCE(SUM(cj.input_tokens + cj.output_tokens + cj.cache_read_tokens + cj.cache_write_tokens), 0) AS total_tokens,
+      COALESCE(SUM(cj.input_tokens + cj.output_tokens + cj.cache_read_tokens + cj.cache_write_tokens + COALESCE(cj.actual_thinking_tokens, 0)), 0) AS total_tokens,
       SUM(
         cj.input_tokens  * mp.input_price_per_1m  / 1000000.0
         + cj.output_tokens * mp.output_price_per_1m / 1000000.0
         + cj.cache_read_tokens  * mp.cache_read_price_per_1m  / 1000000.0
         + cj.cache_write_tokens * mp.cache_write_price_per_1m / 1000000.0
+        + COALESCE(cj.actual_thinking_tokens, 0) * mp.input_price_per_1m / 1000000.0
       ) FILTER (WHERE cj.input_tokens IS NOT NULL) AS total_cost
     FROM claude_jobs cj
     JOIN tasks t ON cj.task_id = t.id
@@ -152,12 +155,13 @@ export async function getPbiTokenAggregates(userId: string, sprintId: string): P
       p.id AS pbi_id,
       p.code AS pbi_code,
       p.title AS pbi_title,
-      COALESCE(SUM(cj.input_tokens + cj.output_tokens + cj.cache_read_tokens + cj.cache_write_tokens), 0) AS total_tokens,
+      COALESCE(SUM(cj.input_tokens + cj.output_tokens + cj.cache_read_tokens + cj.cache_write_tokens + COALESCE(cj.actual_thinking_tokens, 0)), 0) AS total_tokens,
       SUM(
         cj.input_tokens  * mp.input_price_per_1m  / 1000000.0
         + cj.output_tokens * mp.output_price_per_1m / 1000000.0
         + cj.cache_read_tokens  * mp.cache_read_price_per_1m  / 1000000.0
         + cj.cache_write_tokens * mp.cache_write_price_per_1m / 1000000.0
+        + COALESCE(cj.actual_thinking_tokens, 0) * mp.input_price_per_1m / 1000000.0
       ) FILTER (WHERE cj.input_tokens IS NOT NULL) AS total_cost
     FROM claude_jobs cj
     JOIN tasks t ON cj.task_id = t.id
diff --git a/lib/insights/token-stats.ts b/lib/insights/token-stats.ts
index 312c822..41d4a7c 100644
--- a/lib/insights/token-stats.ts
+++ b/lib/insights/token-stats.ts
@@ -16,10 +16,18 @@ export interface TokenJobRow {
   outputTokens: number | null
   cacheReadTokens: number | null
   cacheWriteTokens: number | null
+  thinkingTokens: number | null
   costUsd: number | null
   durationSeconds: number | null
 }
 
+export interface TokenStatsByKindRow {
+  kind: string
+  jobCount: number
+  totalTokens: number
+  totalCostUsd: number
+}
+
 export interface TokenStatsResult {
   kpi: TokenKpi
   jobs: TokenJobRow[]
@@ -41,10 +49,18 @@ type RawJobRow = {
   output_tokens: number | null
   cache_read_tokens: number | null
   cache_write_tokens: number | null
+  actual_thinking_tokens: number | null
   cost_usd: number | null
   duration_seconds: number | null
 }
 
+type RawByKindRow = {
+  kind: string
+  job_count: bigint
+  total_tokens: bigint
+  total_cost: number | null
+}
+
 const EMPTY_KPI: TokenKpi = { totalTokens: 0, totalCostUsd: 0, avgCostPerJob: 0, jobCount: 0 }
 
 export async function getTokenStats(userId: string, sprintId: string): Promise<TokenStatsResult> {
@@ -53,18 +69,20 @@ export async function getTokenStats(userId: string, sprintId: string): Promise<T
   const [kpiRows, jobRows] = await Promise.all([
     prisma.$queryRaw<RawKpiRow[]>`
       SELECT
-        COALESCE(SUM(cj.input_tokens + cj.output_tokens + cj.cache_read_tokens + cj.cache_write_tokens), 0) AS total_tokens,
+        COALESCE(SUM(cj.input_tokens + cj.output_tokens + cj.cache_read_tokens + cj.cache_write_tokens + COALESCE(cj.actual_thinking_tokens, 0)), 0) AS total_tokens,
         SUM(
           cj.input_tokens  * mp.input_price_per_1m  / 1000000.0
           + cj.output_tokens * mp.output_price_per_1m / 1000000.0
           + cj.cache_read_tokens  * mp.cache_read_price_per_1m  / 1000000.0
           + cj.cache_write_tokens * mp.cache_write_price_per_1m / 1000000.0
+          + COALESCE(cj.actual_thinking_tokens, 0) * mp.input_price_per_1m / 1000000.0
         ) FILTER (WHERE cj.input_tokens IS NOT NULL) AS total_cost,
         AVG(
           cj.input_tokens  * mp.input_price_per_1m  / 1000000.0
           + cj.output_tokens * mp.output_price_per_1m / 1000000.0
           + cj.cache_read_tokens  * mp.cache_read_price_per_1m  / 1000000.0
           + cj.cache_write_tokens * mp.cache_write_price_per_1m / 1000000.0
+          + COALESCE(cj.actual_thinking_tokens, 0) * mp.input_price_per_1m / 1000000.0
         ) FILTER (WHERE cj.input_tokens IS NOT NULL) AS avg_cost,
         COUNT(*) FILTER (WHERE cj.input_tokens IS NOT NULL) AS job_count
       FROM claude_jobs cj
@@ -85,11 +103,13 @@ export async function getTokenStats(userId: string, sprintId: string): Promise<T
         cj.output_tokens,
         cj.cache_read_tokens,
         cj.cache_write_tokens,
+        cj.actual_thinking_tokens,
         CASE WHEN cj.input_tokens IS NOT NULL THEN
           cj.input_tokens  * mp.input_price_per_1m  / 1000000.0
           + cj.output_tokens * mp.output_price_per_1m / 1000000.0
           + cj.cache_read_tokens  * mp.cache_read_price_per_1m  / 1000000.0
           + cj.cache_write_tokens * mp.cache_write_price_per_1m / 1000000.0
+          + COALESCE(cj.actual_thinking_tokens, 0) * mp.input_price_per_1m / 1000000.0
         END AS cost_usd,
         EXTRACT(EPOCH FROM (cj.finished_at - cj.claimed_at)) AS duration_seconds
       FROM claude_jobs cj
@@ -122,8 +142,54 @@ export async function getTokenStats(userId: string, sprintId: string): Promise<T
       outputTokens: r.output_tokens,
       cacheReadTokens: r.cache_read_tokens,
       cacheWriteTokens: r.cache_write_tokens,
+      thinkingTokens: r.actual_thinking_tokens,
       costUsd: r.cost_usd != null ? Number(r.cost_usd) : null,
       durationSeconds: r.duration_seconds != null ? Number(r.duration_seconds) : null,
     })),
   }
 }
+
+// PBI-67: per-kind aggregatie. Toont totaal tokens + kosten per ClaudeJob.kind
+// binnen één sprint zodat we de relatieve uitgaven van IDEA_GRILL vs
+// TASK_IMPLEMENTATION etc. kunnen zien. Voor jobs zonder sprint-koppeling
+// (idea-jobs) blijven we filteren op user_id + sprint_id; idea-jobs zonder
+// task vallen buiten deze view.
+export async function getTokenStatsByKind(
+  userId: string,
+  sprintId: string,
+): Promise<TokenStatsByKindRow[]> {
+  if (!sprintId) return []
+
+  const rows = await prisma.$queryRaw<RawByKindRow[]>`
+    SELECT
+      cj.kind::text AS kind,
+      COUNT(*) FILTER (WHERE cj.input_tokens IS NOT NULL) AS job_count,
+      COALESCE(SUM(
+        cj.input_tokens + cj.output_tokens + cj.cache_read_tokens + cj.cache_write_tokens
+        + COALESCE(cj.actual_thinking_tokens, 0)
+      ), 0) AS total_tokens,
+      SUM(
+        cj.input_tokens  * mp.input_price_per_1m  / 1000000.0
+        + cj.output_tokens * mp.output_price_per_1m / 1000000.0
+        + cj.cache_read_tokens  * mp.cache_read_price_per_1m  / 1000000.0
+        + cj.cache_write_tokens * mp.cache_write_price_per_1m / 1000000.0
+        + COALESCE(cj.actual_thinking_tokens, 0) * mp.input_price_per_1m / 1000000.0
+      ) FILTER (WHERE cj.input_tokens IS NOT NULL) AS total_cost
+    FROM claude_jobs cj
+    JOIN tasks t ON cj.task_id = t.id
+    JOIN stories s ON t.story_id = s.id
+    LEFT JOIN model_prices mp ON mp.model_id = cj.model_id
+    WHERE cj.user_id = ${userId}
+      AND s.sprint_id = ${sprintId}
+      AND cj.status = 'DONE'
+    GROUP BY cj.kind
+    ORDER BY total_cost DESC NULLS LAST
+  `
+
+  return rows.map((r) => ({
+    kind: r.kind,
+    jobCount: Number(r.job_count),
+    totalTokens: Number(r.total_tokens),
+    totalCostUsd: Number(r.total_cost ?? 0),
+  }))
+}
diff --git a/lib/job-config-snapshot.ts b/lib/job-config-snapshot.ts
new file mode 100644
index 0000000..43bd290
--- /dev/null
+++ b/lib/job-config-snapshot.ts
@@ -0,0 +1,40 @@
+// PBI-67: snapshot-helper voor ClaudeJob.requested_*-velden.
+//
+// Roep hem aan vóór elke `prisma.claudeJob.create({ data: { ... } })` en spread
+// het resultaat in `data`. Doet één extra Product-query (en optioneel Task)
+// om de override-cascade in te vullen op enqueue-tijd. Bij claim (in scrum4me-
+// mcp/wait-for-job) wordt dezelfde resolver opnieuw aangeroepen — als
+// requested_* dan al gezet zijn winnen die boven product/kind-defaults.
+
+import { prisma } from '@/lib/prisma'
+import { resolveJobConfig, snapshotFromConfig, type ClaudeJobSnapshotFields } from '@/lib/job-config'
+
+export async function getJobConfigSnapshot(opts: {
+  kind: string
+  productId: string
+  taskId?: string | null
+}): Promise<ClaudeJobSnapshotFields> {
+  const [product, task] = await Promise.all([
+    prisma.product.findUnique({
+      where: { id: opts.productId },
+      select: {
+        preferred_model: true,
+        thinking_budget_default: true,
+        preferred_permission_mode: true,
+      },
+    }),
+    opts.taskId
+      ? prisma.task.findUnique({
+          where: { id: opts.taskId },
+          select: { requires_opus: true },
+        })
+      : Promise.resolve(null),
+  ])
+
+  const cfg = resolveJobConfig(
+    { kind: opts.kind },
+    product ?? {},
+    task ?? undefined,
+  )
+  return snapshotFromConfig(cfg)
+}
diff --git a/lib/job-config.ts b/lib/job-config.ts
new file mode 100644
index 0000000..a3c07ff
--- /dev/null
+++ b/lib/job-config.ts
@@ -0,0 +1,141 @@
+// PBI-67: model + mode-selectie per ClaudeJob-kind.
+//
+// Sync with scrum4me-mcp/src/lib/job-config.ts — als je hier een veld
+// aanpast, doe hetzelfde aan de MCP-kant. Dit is bewust een duplicate
+// (geen gedeeld package) om de MCP-server eigenstandig te houden.
+//
+// Override-cascade (eerste match wint):
+//   1. task.requires_opus === true       → forceer Opus
+//   2. job.requested_*  (snapshot bij enqueue, ingevuld door deze module)
+//   3. product.preferred_*
+//   4. KIND_DEFAULTS hieronder
+
+export type ClaudeModel =
+  | 'claude-opus-4-7'
+  | 'claude-sonnet-4-6'
+  | 'claude-haiku-4-5-20251001'
+
+export type PermissionMode = 'plan' | 'default' | 'acceptEdits' | 'bypassPermissions'
+
+export type JobConfig = {
+  model: ClaudeModel
+  thinking_budget: number
+  permission_mode: PermissionMode
+  max_turns: number | null
+  allowed_tools: string[] | null
+}
+
+export type JobInput = {
+  kind: string
+  requested_model?: string | null
+  requested_thinking_budget?: number | null
+  requested_permission_mode?: string | null
+}
+
+export type ProductInput = {
+  preferred_model?: string | null
+  thinking_budget_default?: number | null
+  preferred_permission_mode?: string | null
+}
+
+export type TaskInput = {
+  requires_opus?: boolean | null
+}
+
+const KIND_DEFAULTS: Record<string, JobConfig> = {
+  IDEA_GRILL: {
+    model: 'claude-sonnet-4-6',
+    thinking_budget: 12000,
+    permission_mode: 'plan',
+    max_turns: 15,
+    allowed_tools: ['Read', 'Grep', 'Glob', 'WebSearch', 'AskUserQuestion'],
+  },
+  IDEA_MAKE_PLAN: {
+    model: 'claude-opus-4-7',
+    thinking_budget: 24000,
+    permission_mode: 'plan',
+    max_turns: 20,
+    allowed_tools: ['Read', 'Grep', 'Glob', 'WebSearch', 'AskUserQuestion', 'Write'],
+  },
+  PLAN_CHAT: {
+    model: 'claude-sonnet-4-6',
+    thinking_budget: 6000,
+    permission_mode: 'plan',
+    max_turns: 5,
+    allowed_tools: ['Read', 'Grep', 'AskUserQuestion'],
+  },
+  TASK_IMPLEMENTATION: {
+    model: 'claude-sonnet-4-6',
+    thinking_budget: 6000,
+    permission_mode: 'bypassPermissions',
+    max_turns: 50,
+    allowed_tools: null,
+  },
+  SPRINT_IMPLEMENTATION: {
+    model: 'claude-sonnet-4-6',
+    thinking_budget: 6000,
+    permission_mode: 'bypassPermissions',
+    max_turns: null,
+    allowed_tools: null,
+  },
+}
+
+const FALLBACK: JobConfig = {
+  model: 'claude-sonnet-4-6',
+  thinking_budget: 6000,
+  permission_mode: 'default',
+  max_turns: 50,
+  allowed_tools: null,
+}
+
+export function getKindDefault(kind: string): JobConfig {
+  return KIND_DEFAULTS[kind] ?? FALLBACK
+}
+
+// max_turns en allowed_tools blijven kind-default (geen product/task override
+// in V1 — als de behoefte ontstaat, voeg analoge velden toe aan Product/Task).
+export function resolveJobConfig(
+  job: JobInput,
+  product: ProductInput,
+  task?: TaskInput,
+): JobConfig {
+  const base = getKindDefault(job.kind)
+
+  const model = (
+    task?.requires_opus
+      ? 'claude-opus-4-7'
+      : job.requested_model ?? product.preferred_model ?? base.model
+  ) as ClaudeModel
+
+  const thinking_budget =
+    job.requested_thinking_budget ?? product.thinking_budget_default ?? base.thinking_budget
+
+  const permission_mode = (job.requested_permission_mode ??
+    product.preferred_permission_mode ??
+    base.permission_mode) as PermissionMode
+
+  return {
+    model,
+    thinking_budget,
+    permission_mode,
+    max_turns: base.max_turns,
+    allowed_tools: base.allowed_tools,
+  }
+}
+
+// Snapshot-velden voor ClaudeJob.requested_*. Bij elke enqueue laden we
+// product (voor preferred_*) en optioneel task (voor requires_opus), draaien
+// de resolver, en schrijven het resultaat als auditspoor in de job-rij.
+export type ClaudeJobSnapshotFields = {
+  requested_model: string
+  requested_thinking_budget: number
+  requested_permission_mode: string
+}
+
+export function snapshotFromConfig(cfg: JobConfig): ClaudeJobSnapshotFields {
+  return {
+    requested_model: cfg.model,
+    requested_thinking_budget: cfg.thinking_budget,
+    requested_permission_mode: cfg.permission_mode,
+  }
+}
diff --git a/prisma/migrations/20260508085909_add_job_model_selection_fields/migration.sql b/prisma/migrations/20260508085909_add_job_model_selection_fields/migration.sql
new file mode 100644
index 0000000..20b891a
--- /dev/null
+++ b/prisma/migrations/20260508085909_add_job_model_selection_fields/migration.sql
@@ -0,0 +1,18 @@
+-- PBI-67: Model + mode-selectie per ClaudeJob-kind
+--
+-- Additieve migration: nieuwe optionele kolommen op products, tasks en
+-- claude_jobs voor de override-cascade
+--   task.requires_opus → job.requested_* → product.preferred_* → kind-default
+-- Bestaande rijen krijgen NULL (Product/ClaudeJob) of false (Task.requires_opus)
+-- en vallen daarmee terug op kind-defaults uit de resolver.
+
+ALTER TABLE "products" ADD COLUMN "preferred_model" TEXT;
+ALTER TABLE "products" ADD COLUMN "thinking_budget_default" INTEGER;
+ALTER TABLE "products" ADD COLUMN "preferred_permission_mode" TEXT;
+
+ALTER TABLE "tasks" ADD COLUMN "requires_opus" BOOLEAN NOT NULL DEFAULT false;
+
+ALTER TABLE "claude_jobs" ADD COLUMN "requested_model" TEXT;
+ALTER TABLE "claude_jobs" ADD COLUMN "requested_thinking_budget" INTEGER;
+ALTER TABLE "claude_jobs" ADD COLUMN "requested_permission_mode" TEXT;
+ALTER TABLE "claude_jobs" ADD COLUMN "actual_thinking_tokens" INTEGER;
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 8106a3b..ef65cce 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -208,6 +208,9 @@ model Product {
   definition_of_done String
   auto_pr            Boolean          @default(false)
   pr_strategy        PrStrategy       @default(SPRINT)
+  preferred_model            String?
+  thinking_budget_default    Int?
+  preferred_permission_mode  String?
   archived           Boolean          @default(false)
   created_at         DateTime         @default(now())
   updated_at         DateTime         @updatedAt
@@ -363,6 +366,7 @@ model Task {
   status                 TaskStatus            @default(TO_DO)
   verify_only            Boolean               @default(false)
   verify_required        VerifyRequired        @default(ALIGNED_OR_PARTIAL)
+  requires_opus          Boolean               @default(false)
   // Override product.repo_url for branch/worktree/push purposes. Set when
   // a task targets a different repo than its parent product (e.g. an
   // MCP-server task tracked under the main product's PBI). Falls back to
@@ -408,6 +412,10 @@ model ClaudeJob {
   output_tokens       Int?
   cache_read_tokens   Int?
   cache_write_tokens  Int?
+  requested_model            String?
+  requested_thinking_budget  Int?
+  requested_permission_mode  String?
+  actual_thinking_tokens     Int?
   plan_snapshot       String?
   base_sha            String?
   head_sha            String?