Permission gate evaluation order

Permission gate evaluation order A workflow diagram generated by Archify. 01 / Checks, in order EX / Outcomes Selected tool call · role · policy · target · Checks, in order Selected tool call role · policy · target Hard denies · git push · vault · .hey-dave · Checks, in order Hard denies git push · vault · .hey-dave Deny rules · config + this session · Checks, in order Deny rules config + this session Modes · confine · memory-only · plan · confine · Checks, in order Modes · confine memory-only · plan · confine Always ask · ask rules · outward · Checks, in order Always ask ask rules · outward Grants · reads · session · allow rules · reads · Checks, in order Grants · reads session · allow rules · reads DENY · denial as the result · Outcomes DENY denial as the result ASK → card · once · session · project · all · Outcomes ASK → card once · session · project · all Run tool · ALLOW · Outcomes Run tool ALLOW match deny matched match otherwise Legend Agent logic Policy Tool action

Denies win

  • • Hard denies, deny rules, session denies, memory-only Task work, plan and confine all stop the call
  • • No allow rule or grant can override them

Asking

  • • Ask rules and outward writes beat grants
  • • A card answer can add a session or project rule