Permissions¶

techrevati.runtime.permissions ¶

Permissions — Role-based tool access gating.

Deny-first authorization: denied_tools is checked first, then mode comparison, then the allowed_tools whitelist. Each role has a PermissionMode that determines which tools it can use.

This module is configuration-free by design; callers supply their own RolePermissionConfig and tool_requirements.

PermissionMode ¶

Bases: IntEnum

Ordered permission levels. Higher grants more access.

PermissionOutcome `dataclass` ¶

PermissionOutcome(
    allowed, reason=None, active_mode="", required_mode=""
)

Result of a permission check.

RolePermissionConfig `dataclass` ¶

RolePermissionConfig(
    role, mode, allowed_tools=None, denied_tools=list()
)

Permission configuration for a single role.

PermissionPolicy ¶

PermissionPolicy(
    role_configs=None,
    tool_requirements=None,
    *,
    default_allow_unknown_roles=True,
)

Evaluates tool access based on role configs and tool requirements.

PermissionEnforcer ¶

PermissionEnforcer(policy)

Wraps PermissionPolicy for convenient enforcement.

filter_tools ¶

filter_tools(role, tools)

Return only tools the role is permitted to use.