Module permissions 

Permission system for controlling agent access to resources. Permission system for controlling agent access to resources.

This module implements a grant-based permission system where permissions are represented as tuples of (Target, Level):

• Target: What resource is being accessed (path, domain, or command)
• Level: What level of access is permitted (read, write, execute, admin)

Permission Levels

Permission levels form a hierarchy where higher levels imply lower levels:

Admin > Execute > Write > Read > None

For example, a Write grant automatically allows Read operations.

Target Types

Target	Controls	Examples
Path	Files and directories	/project/src, /home/user/.config
Domain	Network endpoints	api.github.com, *.anthropic.com
Command	Shell commands	git *, cargo build

Batch Requests

When multiple tools run in parallel, their permission requests can be batched together for a single UI prompt, avoiding deadlocks and reducing user friction.

Example

use agent_core_runtime::permissions::{Grant, GrantTarget, PermissionLevel, PermissionRequest};

// Create a grant for writing to /project/src recursively
let grant = Grant::write_path("/project/src", true);

// Create a request to write a file
let request = PermissionRequest::file_write("req-1", "/project/src/main.rs");

// Check if the grant satisfies the request
assert!(grant.satisfies(&request));

// Write grant also satisfies read requests (level hierarchy)
let read_request = PermissionRequest::file_read("req-2", "/project/src/lib.rs");
assert!(grant.satisfies(&read_request));

Structs

BatchPermissionRequest

A batch of permission requests from parallel tool executions.

BatchPermissionResponse

Response to a batch permission request.

Grant

A permission grant combining a target and permission level.

PendingPermissionInfo

Information about a pending permission request for UI display.

PermissionPanelResponse

Response from the UI to a permission request.

PermissionRegistry

Registry for managing permission grants and requests.

PermissionRequest

A request for permission to perform an operation.

ToolPermissions

Helper functions for creating tool-specific permission requests.

Enums

BatchAction

User actions for responding to a batch permission request.

GrantTarget

The target of a permission grant.

PermissionError

Error types for permission operations.

PermissionLevel

Permission level that determines what operations are allowed.

ToolCategory

Tool categories for permission mapping.

Functions

compute_suggested_grants

Computes suggested grants that would cover all requests.

generate_batch_id

Generates a unique batch ID.

get_tool_category

Gets the tool category from a tool name.