Manage permissions¶

Goal: Grant the right capabilities to a workflow without over-broadening trust, and inspect / revoke approvals after the fact.

Three places to set permissions¶

Layer	Lives in	Granularity
Phase declaration	Phase frontmatter	Per phase + per (op, path)
Saved approvals	`.reyn/approvals.yaml`	Per (workflow, op, path)
Project-wide pre-approval	`reyn.yaml` `permissions:`	Per op kind

The defaults are conservative; the rest is opt-in. See the permission model concept for the why.

Declare in a phase¶

---
type: phase
name: writeout
input: report
permissions:
  shell: false
  file:
    write:
      - path: /tmp/output
        scope: just_path
  python:
    - module: stats
      function: compute
      mode: safe
      timeout: 30
---

scope: just_path matches the exact path; recursive matches a directory and all descendants.

Approve at startup¶

When the workflow needs something not in the defaults, the runtime prompts:

[approval] my_skill/file.write needs:
  /tmp/output (just_path)

  [y] allow this run only
  [j] persist for this exact path + skill
  [r] persist for the parent dir (recursive) + skill
  [N] deny

j and r write to .reyn/approvals.yaml.

Pre-approve project-wide¶

# reyn.yaml
permissions:
  shell: allow
  file.write: allow
  python:
    safe: allow        # python steps are always sandboxed (safe mode only)

allow removes the prompt entirely. ask (default) prompts. deny rejects.

Inspect saved approvals¶

reyn permissions list

Output groups entries by workflow, then by op kind:

  [my_skill]
    ✓ write  /tmp/output  (just_path)
    ✓ read   ~/notes      (recursive)

Revoke¶

reyn permissions revoke my_skill/file.write//tmp/output
reyn permissions clear     # remove all (asks for confirmation)

Non-interactive mode¶

reyn run-once is non-interactive. Pre-arrange every approval the agent needs:

run once interactively first and persist via [j] or [r], OR
pre-approve in reyn.yaml.

Without prior approval the run fails at the ungranted capability.