Permissions & approval

Every privileged action passes through PermissionEvaluation. The policy is deny-by-default and human-in-the-loop.

Evaluation

A request is evaluated against:

Protected path rules (ProtectedPathRule)
Destructive command rules (DestructiveCommandRule)
Per-tenant allowlist / blocklist
Per-agent capability grants

The first match wins. No match means deny.

Approval

When a request is denied, the agent may request approval:

approve

# Approval is captured by the active harness prompt
Request : rm -rf build/
Reason  : clean stale build
Decision: approve once / deny / ask for safer alternative

Trace   : permission.decision { actor: "human", scope: "once" }

All approvals write a permission.decision trace event with actor: human. TTLs are enforced.

Scopes

Scope	Effect
`--once`	One-time use, expires after the action.
`--ttl`	Valid for N minutes after the decision.
`--session`	Valid until the current agent session ends.
`--permanent`	Persisted to `.ai/policies/`. Reviewer sign-off required.

Audit

audit

ls .ai/observability/generated
ls .alfred/observability