Permission System

Preview

Capabilities, scope intersection and policy evaluation.

Capabilities are additive grants, never implicit. If a capability was not granted, the corresponding tool does not exist from the agent’s perspective.

Effective capability set#

workspace policy  ∩  API key scopes  ∩  task request  ∩  connector grant
                              ║
                              ▼
                    effective capability set

  · intersection only — nothing in the chain can widen another
  · re-evaluated at every dispatch, not cached per run
  · an empty intersection means the tool is unavailable, not denied at runtime

Capability namespace#

Scope	Grants	Risk
`research.web`	Fetch and search public web content	Low
`files.read` / `files.write`	Sandbox filesystem access	Low
`code.execute`	Run code in a sandbox	Moderate
`tools.synthesize`	Create dynamic tools at runtime	Moderate
`computer.browser`	Drive a browser session	Moderate
`computer.gui`	Full desktop control	High
`connector.*`	Access a named external system	Varies
`codebase.read`	Read and index repository source	Low
`codebase.write`	Apply patches to a working branch	High
`codebase.dependency`	Add or upgrade a dependency	Critical
`memory.write`	Persist long-term memory	Moderate

Last updated 2026-09-16