Tool Permissions

Preview

Scopes, policy evaluation and approval requirements for tool execution.

Every tool call is evaluated against policy at dispatch time. Permission is never inferred from context, prior approval of a similar call, or model confidence.

Evaluation order#

tool call
   │
   ├─▶ 1. is the scope in the effective capability set?        no ─▶ deny
   ├─▶ 2. does a workspace policy rule deny it?                yes ─▶ deny
   ├─▶ 3. does the effect class require approval?              yes ─▶ request approval
   ├─▶ 4. are resource constraints satisfied (allowlist,
   │       spend cap, rate limit, time window)?                no ─▶ deny
   └─▶ 5. allow ─▶ execute (logged)

Policy example#

workspace-policy.yaml (conceptual)

version: class="tok-num">1
workspace: ws_engineering

capabilities:
  allow:
    - research.web
    - files.read
    - files.write
    - code.execute
    - connector.github
  deny:
    - computer.gui
    - codebase.dependency

rules:
  - match: { tool: class="tok-str">"github.*", operation: class="tok-str">"write" }
    require: approval
    approvers: [class="tok-str">"team:platform-leads"]

  - match: { tool: class="tok-str">"web.fetch" }
    constrain:
      domains_allow: [class="tok-str">"*.example.com", class="tok-str">"docs.*", class="tok-str">"arxiv.org"]
      max_bytes: class="tok-num">5242880

  - match: { effect_class: class="tok-str">"communication" }
    require: approval

budgets:
  per_task: { usd: class="tok-num">20, tool_calls: class="tok-num">400 }
  per_day:  { usd: class="tok-num">250 }

Decision	Behaviour	Logged
`allow`	Call executes immediately	Yes
`approval`	Run pauses with an approval request	Yes
`deny`	Call rejected; planner must find another route	Yes, with rule reference
`deny_hard`	Call rejected and the run terminates	Yes, with alert

Last updated 2026-09-13