Interactive Permissions

The Interactive Permissions extension classifies command risk, applies persistent policies, and prompts the user when a decision is needed. All decisions are recorded in Cortex for audit trails.

Decision pipeline

mermaid
flowchart TD
    A[Tool call] --> B{Is exec tool?}
    B -->|no| C{defaultDeny?}
    C -->|yes| X[DENY]
    C -->|no| Y[ALLOW]
    B -->|yes| D[Classify risk]
    D --> E{Safe + autoApproveSafe?}
    E -->|yes| Y
    E -->|no| F{Matching policy?}
    F -->|always_allow| Y
    F -->|always_deny| X
    F -->|ask| G[Prompt user]
    F -->|no match| G
    G -->|allow| Y
    G -->|deny| X

The hook runs at priority 200 — after the Bash Sandbox (250) and before LLM Hooks.

Risk classification

Every shell command is classified into one of five risk levels:

LevelExamplesAction
safels, cat, grep, git status, git log, git diffAuto-approve (if enabled)
lowgit add, npm install, mkdir, cp, mvPolicy or prompt
mediumgit commit, git push, curl, docker runPolicy or prompt
highrm -rf, git push --force, git reset --hard, curl | bash, evalPolicy or prompt
criticalrm -rf /, mkfs, dd if=, fork bomb, shutdownAlways prompt

The classifier uses pattern matching on the command string, returning the highest-risk match found.

Persistent policies

Policies define automatic decisions for recurring tool calls. Stored in Cortex and loaded on startup.

json5
{
  id: "policy-1234-1",
  kind: "always_allow",       // "always_allow" | "always_deny" | "ask"
  matcher: "git commit*",     // Pattern to match
  matcherType: "glob",        // "exact" | "glob" | "regex"
  maxRiskLevel: "medium",     // Only apply up to this risk level
  source: "manual"            // "manual" | "learned"
}

Matcher precedence

  1. Policies with commandPattern match first (most specific)
  2. Policies with wildcard * match last (most general)
  3. First matching policy wins

Managing policies

bash
mayros permissions list                          # Show all policies
mayros permissions add "git *" --kind always_allow --type glob
mayros permissions add "npm publish" --kind ask --risk medium
mayros permissions remove policy-1234-1

Cortex audit trail

Every permission decision is recorded as RDF triples in Cortex:

{ns}:permission:decision:{hash} → toolName → "exec"
{ns}:permission:decision:{hash} → riskLevel → "medium"
{ns}:permission:decision:{hash} → allowed → "true"
{ns}:permission:decision:{hash} → decidedBy → "policy"

Decision sources:

SourceMeaning
auto_safeAuto-approved (safe command + autoApproveSafe)
policyMatched a stored policy
user_promptUser was prompted and decided
deny_defaultNo match + defaultDeny enabled

View recent decisions:

bash
mayros permissions audit --limit 20

Agent tools

ToolDescription
permissions_classifyClassify a command's risk level and matched patterns

Configuration

json5
{
  interactivePermissions: {
    autoApproveSafe: true,          // Auto-approve safe commands
    defaultDeny: false,             // Deny unmatched tools
    policyEnabled: true,            // Enable persistent policies
    maxStoredDecisions: 500,        // Max audit decisions (1–10000)
    agentNamespace: "mayros",       // RDF namespace
  }
}