Skill · aci · permissions
Allow / ask / deny
Put every side-effecting tool behind allow / ask / deny in code. Use when the agent can write, deploy, refund, browse, exec, or the user mentions permission model, approvals, 'the model should be careful', or wants to enforce policy in the system prompt.
GET /api/canon/skills/permissions?format=md
The model is a confused deputy. 'Never delete files' in a system prompt is not an enforcement mechanism. OpenHands, Cline, and Codex all gate writes.
When
The agent can touch a workspace, a browser, or production. The model proposes; code decides.
Do
- 01
Classify every tool
allow (read, grep, tests), ask (write, refund, deploy, browser), deny (rm -rf, prod creds, unrestricted net).
- 02
Ask is a pause
Show the exact command, diff, or payload. Checkpoint. Resume without re-executing if already done.
- 03
Log the gate
Every allow/ask/deny is a span. Irreversible actions are high-friction asks.
Don't
- Enforce policy only in the system prompt.
- Auto-approve MCP servers from a marketplace.
- Let subagents inherit parent deploy keys.
Hard rules
- Security is an allowlist in the executor.
- Plan mode is a permission change (deny writes), not a personality.
- Secrets stay in the executor, never the prompt.
Refuse
- Security by system prompt — 'Never delete files' as the only guard. The model is a confused deputy and will try to help.
- Unsandboxed exec — A shell or code-act tool on the host with production credentials.
- HITL that cannot resume — The human answers and the run is gone. Approval as a side channel, not a tool.
Load with this
Load next
- Humans as toolsA side effect needs a person, or the agent is missing information only a person has.
- Sandbox and injectionThe agent has a shell, a browser, documents, or plugins. The model is a confused deputy.
- Plan / actSide effects need a human-agreed shape. Plan is a file, not a thought.
- Design the ACIYou are adding or reviewing tools. The ACI is the prompt you cannot see.
Trigger tests
Should fire
- “Add an approval gate before deploys”
- “The agent should not write without asking”
- “Implement allow/ask/deny”
Should not
- “Add OAuth to the Next.js app”
- “Set up RBAC for the admin panel”