safety/permission-gate

A mutation permission gate evaluates every write request against declared permission surfaces before execution. It fires before any filesystem, vault, or external action proceeds, ensuring no operation bypasses workspace safety constraints.

A mutation permission gate intercepts every write, export, or external action request and evaluates it against declared permission surfaces. It prevents unauthorized filesystem or vault mutations by enforcing workspace constraints before any operation proceeds.

Automatic logging for mutation decisions is implemented by configuring the permission gate to record every approval, denial, and boundary-violation handling event. This produces an audit-ready trace of all mutation decisions for compliance and review.

Yes, you can configure mutation defaults to either auto-approve or require explicit approval. The permission gate evaluates each request against the Claw's declared permission surface and applies the configured default for actions not explicitly covered.

Yes, the permission gate applies across all Claws that declare a permission surface in CLAW.md. It automatically evaluates mutation requests from any such Claw, ensuring no declared write operation bypasses the gate.

When a mutation request violates workspace safety boundaries, the permission gate intercepts and blocks the action before execution. It handles the boundary violation according to configured rules and logs the decision for audit traceability.