Permission belongs to an operation, a revision, and a lifetime

A tool can be enabled without its domain action being authorized. A human can approve a local edit without approving publication. A new session can reuse an extension closure without inheriting the same kind of persisted permission as another example.

The Extension part makes these distinctions concrete. Continuity explains why they remain important when the active conversation moves, and Tan explains why Main’s protections cannot simply be presumed to follow another runtime. The Permissions part adds the operator’s resolution path: which declaration, effective policy key, mode, and UI capability govern this particular call?

The title’s operation/revision/lifetime discipline is a design principle, not a claim that the generic tool-approval dialog implements every domain revision check. Its binary answer admits one call; the domain must still validate its own object and authority.

Compare the examples without flattening their policies

Even the persisted-data validation policies differ. Seed Desk refuses malformed matching snapshots rather than skipping them. Review Desk’s small fixture skips entries that fail its state predicate. Preserve that distinction when studying recovery; the examples do not define one universal corruption policy.

Resolve host approval without inventing a domain grant

Approval Desk: modes and policies establishes a precise order. Tool deny and effective user deny are checked before automatic mode admission. Explicit tool allow or prompt can outrank a non-deny user policy. An override-only prompt is not an unbypassable policy in yolo. Consequently, neither “the user record always wins” nor “yolo disables every gate” is an accurate summary.

Dispatch Desk adds policy identity. A valid device policy replaces the invoking write fallback; it is not an intersection with every policy in the record. The outer transport borrows a tier, while an applicable inner wrapper can still deny. xdevApproved suppresses a particular unchanged-input duplicate prompt, not every nested check. A supported input replacement can require reclassification, and the source predicate is not a universal content-revision guard.

The generic one-call boundary offers Approve and Deny only. Dismissal is not approval, and an approval does not persist an allow-for-session setting. Two questions at outer and inner device gates can still precede only one execution. None of those answers creates Seed Desk’s branch grant or Review Desk’s revision-bound one-action authority.

Authority and concurrency are separate checks

Seed Desk re-reads its revision after awaiting human confirmation. Review Desk uses generation invalidation to prevent an old dialog answer from reviving authority. Both respond to the same asynchronous hazard: the context that made a decision meaningful may have changed while the UI was waiting.

A current revision does not supply permission, and permission does not make an old revision current. On a stale refusal, inspect again and reconsider the action; do not merely substitute a newer token into an unchanged request.

These revisions are domain-specific. Seed Desk’s token, Review Desk’s counter, a workbook page revision, and a provider-facing session ID are not interchangeable concurrency controls. The generic wrapper’s supported pre-approval input replacement and Review Desk’s pending-dialog generation invalidation also remain different mechanisms.

UI, launch, and child construction are distinct boundaries

When the host can ask separates terminal presence from an installed UI adapter. RPC can provide select requests through its transport. ACP form support is capability-dependent, and a non-no-op adapter can still return an unavailable value for a particular operation. Print/no-UI execution fails closed when this generic gate requires a prompt. None of those statements proves physical keyboard behavior or every native component.

Configuration and launch precedence explains why a displayed always-ask setting can coexist with wrapper yolo: the execute-time autoApprove boolean can outrank the configured mode. This does not remove an effective explicit deny or acknowledge pending provider safety checks.

Subagents and inherited policies traces both Task construction and TanCommandController.start() to createSubagentSettings(). The helper defaults child mode to yolo while retaining per-tool policy values, and explicit helper overrides are applied afterward. Initial construction, later live runtime inputs, and conversation ancestry are not one inheritance contract. No universal live synchronization or safeguard clone is established.

Reload is not a universal revocation boundary

The source’s AgentSession.reload() reopens the current session through switchSession(). It does not establish that every extension factory is imported and rebound. Review Desk uses the switch path to invalidate its authority. Field Notes deliberately retains its factory-local selection.

Therefore neither “reload clears everything” nor “reload preserves everything” is a sound rule. State the intended lifetime, implement its transitions, and test those transitions through the actual host. Restarting the explicit launch is the source workbook’s reliable procedure for testing extension code edits, not a claim that every hot-reload route is equivalent.

Give the agent an interface, not implied authority

A model-required capability needs a supported tool, not a suggestion to invoke a human slash command. Humans and tools should share mandatory domain rules when both can reach the same action. A human command path is not cryptographic proof of a human keystroke: SDK and RPC hosts can deliberately dispatch command text.

Host approval controls execution under the host’s policy. Domain grants control the example’s operation. Pending provider safety acknowledgement is another gate. Operating-system and broker policy control a different boundary. The supplied isProjectTrusted() compatibility method and trusted-file selection do not sandbox arbitrary extension JavaScript or its imports.

This matters especially for unattended tangents and permission-denied file fallbacks. Verify the actual subagent settings and installed safeguards rather than assuming Main’s experience follows it. A fallback adapter must refuse the wrong session or destination and rely on a real broker; returning success before the exact write has completed is not permission-aware behavior. That is a host-design contract, not a request to use a privileged broker for this workbook. Approval is not a sandbox preserves the distinction between application admission, a denied primitive, and a verified effect.

Source trail: Seed Desk reservations, Review Desk, Discovery, installation and reload, and File fallbacks. Supplied examples include examples/seed-desk/03-reservations/desk.ts — reconstruct, changeReservation; examples/review-desk/index.ts — stateFor, invalidateAuthority; and examples/package-lab/multi/index.ts — the factory-local selected variable. New permissions anchors include packages/coding-agent/src/tools/approval.ts — resolveApproval; extensibility/extensions/wrapper.ts — ExtensionToolWrapper.execute; modes/rpc/rpc-mode.ts — runRpcMode; and task/executor.ts — createSubagentSettings, with the latter abbreviated paths relative to packages/coding-agent/src/. Their recorded checks remain scoped in Permissions evidence.

Related chapters:

• Prepare a reversible lab
• Seed Desk: reservations on the active branch
• Review Desk: edit and decide locally
• Package Lab: one file to an embedded host
• Discovery, installation and reload
• Tools, interception and native delegation
• Permission-denied file fallbacks
• Decision Desk refusals and failures
• 2. Start from Main
• Four places knowledge can live
• Approval Desk: modes and policies
• Dispatch Desk: device and path gates
• Boundary Desk: one call at a time
• Boundary Desk: when the host can ask
• Configuration and launch precedence
• Subagents and inherited policies
• Approval is not a sandbox
• Recovery without widening permission