Rulvar API reference / @rulvar/core / AgentProfilePermissions
Interface: AgentProfilePermissions
Defined in: packages/core/src/runtime/permission-chain.ts:126
Profile-level permissions. inheritPermissions governs SUBAGENT inheritance: a child gets the engine layer and its own profile layers only, unless the profile opts in, in which case the spawning agent's layer (its chain above the engine layer) is prefixed ahead of the child's own (RV4912). The spawning layers carry that layer on the scope state and hand it to compilePermissionChain as its third argument.
Extends
Properties
| Property | Type | Description | Inherited from | Defined in |
|---|---|---|---|---|
approvalDeadlineMs? | number | Opt-in deadline for ask verdicts (RV1107): a suspended tool approval nobody resolves within this many milliseconds is DENIED by a journaled resolution by 'timeout' instead of waiting forever. The deadline is journaled ON the suspension entry, so it survives resume and re-arms from the entry, exactly like the flavor B escalation deadline; a racing live decision and the timeout can never both apply (first-closing-wins). A positive integer no larger than the deadline ceiling (one hundred years in milliseconds, RV1204), so now + interval always journals as a valid absolute date. Absent is the historical contract: the approval waits indefinitely. | PermissionConfig.approvalDeadlineMs | packages/core/src/runtime/permission-chain.ts:95 |
ask? | PermissionRule[] | - | PermissionConfig.ask | packages/core/src/runtime/permission-chain.ts:63 |
canUseTool? | CanUseTool | - | PermissionConfig.canUseTool | packages/core/src/runtime/permission-chain.ts:64 |
deny? | PermissionRule[] | - | PermissionConfig.deny | packages/core/src/runtime/permission-chain.ts:62 |
hookAllow? | "decisive" | "advisory" | The precedence of a hook's allow over the deny tables (RV4911, the tenth comparison experiment's review). Under the documented order a hook's 'allow' decides before the deny rules are read, so for a tool without needsApproval one engine level allow hook silently retires every profile deny rule, the readonly isolation rule and the pilot profile's denial. 'decisive' is that order, the default, byte identical. Under 'advisory' the allow still ends the hook layer (which hooks run does not change) but it is HELD: the deny rules are evaluated over the hook modified input, a match denies, and only then does the held allow decide (ask rules, canUseTool and the terminal default are not consulted, exactly as before). Deny and ask verdicts keep their power, input modification still applies, and strictApprovals keeps its own precedence over the allow. Merges monotonically across the engine, inherited and profile layers: any layer arming 'advisory' arms it. A value outside the two refuses at compile (the RV610 posture). | PermissionConfig.hookAllow | packages/core/src/runtime/permission-chain.ts:114 |
hooks? | PermissionHook[] | - | PermissionConfig.hooks | packages/core/src/runtime/permission-chain.ts:61 |
inheritPermissions? | boolean | Default false: the child's chain is the engine layer plus its own profile layers. True prefixes the spawning agent's chain above the engine layer (its hooks, rules, canUseTool, modes, and the deny rule its readonly isolation compiled) ahead of the child's own layers, so a parent deny reaches the child (RV4912). A non boolean refuses at compile. | - | packages/core/src/runtime/permission-chain.ts:137 |
preset? | "strict" | "standard" | "open" | Compiles into deny/ask rules; ships in M5. | - | packages/core/src/runtime/permission-chain.ts:128 |
strictApprovals? | boolean | Opt-in monotonic approval composition (RV1507, the eighteenth improvement plan). The chain's documented order lets a generic allow (a hook or canUseTool) clear a needsApproval: true tool, which is deliberate for tests and trusted hosts and a fail-open hazard for a platform profile. With this set, an ALLOW verdict from a hook or from canUseTool over a needsApproval tool falls through instead of deciding, so the terminal default still asks; deny and ask verdicts keep their power (tightening stays decisive), input modification still applies, and tools without the declaration keep the historical composition byte for byte. Merges monotonically across the engine and profile layers: either level arms it and a profile cannot loosen an engine-armed mode. A non-boolean value refuses at compile (the RV610 posture: a stray 'true' string must never silently disarm the mode it names). | PermissionConfig.strictApprovals | packages/core/src/runtime/permission-chain.ts:81 |