Tool permissions

Pro

What each tool an agent may call is allowed to do: always, ask first, or never. Tools are grouped by effect (reads, writes, deploys, calls outside the app) so the risky ones are easy to find. An option policy doesn't allow stays visible and says why.

Markdown

Preview

Install

With the Candor CLI

First time? Get started sets up the registry and theme. Or with shadcn directly: npx shadcn@latest add @candor/tool-permissions

Brings in: know, locale, tooltip, utils

Usage

TSX · The example above
"use client"

import * as React from "react"
import { ToolPermissions } from "@/components/tool-permissions"
import type { ToolSetting } from "@/lib/know"

export default function Example() {
  const [tools, setTools] = React.useState<ToolSetting[]>([
    { id: "t1", name: "db.describe", description: "Read tables, columns, indexes and constraints", effect: "read", permission: "always" },
    { id: "t2", name: "repo.search", description: "Search the connected repositories", effect: "read", permission: "always" },
    { id: "t3", name: "migration.apply", description: "Apply a migration to Staging", effect: "write", permission: "ask" },
    { id: "t4", name: "flags.set", description: "Turn a feature flag on or off in Staging", effect: "write", permission: "ask" },
    { id: "t5", name: "prod.deploy", description: "Deploy to Production", effect: "deploy", permission: "never", locked: { always: "Production deploys always go through an approval request." } },
    { id: "t6", name: "slack.post", description: "Post a message to a Slack channel", effect: "outside", permission: "ask", locked: { always: "Messages outside Keel need someone to approve each one." } },
  ])
  return <ToolPermissions className="max-w-2xl" tools={tools} onChange={(id, permission) => setTools((ts) => ts.map((t) => (t.id === id ? { ...t, permission } : t)))} />
}

<ToolPermissions>

PropTypeDefaultDescription
toolsrequiredToolSetting[]—Every tool the agent may call, with its effect, current permission and any options policy rules out.
onChangerequired(id: string, permission: ToolPermission) => void—Called with the tool id and the chosen permission.
classNamestring | undefined—Extra classes for the outer element.

Strings

The fixed words, in English by default. Change any of them under toolPermissions in <LocaleProvider strings={{ … }}>; the table is exported as toolPermissionsStrings.

KeyEnglish
toolPermissionsTool permissions
toolsTools
countAlways{count} always
countAsk{count} ask first
countNever{count} never
readReads
writeWrites
deployDeploys
outsideSends data out
permission{name} permission
alwaysAlways
askAsk
neverNever