Tool permissions
ProWhat each tool an agent may call is allowed to do: always, ask first, or never. Tools are grouped by effect (reads, writes, deploys, calls outside the app) so the risky ones are easy to find. An option policy doesn't allow stays visible and says why.
Preview
Install
With the Candor CLI
First time? Get started sets up the registry and theme. Or with shadcn directly: npx shadcn@latest add @candor/tool-permissions
Usage
"use client"
import * as React from "react"
import { ToolPermissions } from "@/components/tool-permissions"
import type { ToolSetting } from "@/lib/know"
export default function Example() {
const [tools, setTools] = React.useState<ToolSetting[]>([
{ id: "t1", name: "db.describe", description: "Read tables, columns, indexes and constraints", effect: "read", permission: "always" },
{ id: "t2", name: "repo.search", description: "Search the connected repositories", effect: "read", permission: "always" },
{ id: "t3", name: "migration.apply", description: "Apply a migration to Staging", effect: "write", permission: "ask" },
{ id: "t4", name: "flags.set", description: "Turn a feature flag on or off in Staging", effect: "write", permission: "ask" },
{ id: "t5", name: "prod.deploy", description: "Deploy to Production", effect: "deploy", permission: "never", locked: { always: "Production deploys always go through an approval request." } },
{ id: "t6", name: "slack.post", description: "Post a message to a Slack channel", effect: "outside", permission: "ask", locked: { always: "Messages outside Keel need someone to approve each one." } },
])
return <ToolPermissions className="max-w-2xl" tools={tools} onChange={(id, permission) => setTools((ts) => ts.map((t) => (t.id === id ? { ...t, permission } : t)))} />
}<ToolPermissions>
| Prop | Type | Default | Description |
|---|---|---|---|
| toolsrequired | ToolSetting[] | — | Every tool the agent may call, with its effect, current permission and any options policy rules out. |
| onChangerequired | (id: string, permission: ToolPermission) => void | — | Called with the tool id and the chosen permission. |
| className | string | undefined | — | Extra classes for the outer element. |
Strings
The fixed words, in English by default. Change any of them under toolPermissions in <LocaleProvider strings={{ … }}>; the table is exported as toolPermissionsStrings.
| Key | English |
|---|---|
| toolPermissions | Tool permissions |
| tools | Tools |
| countAlways | {count} always |
| countAsk | {count} ask first |
| countNever | {count} never |
| read | Reads |
| write | Writes |
| deploy | Deploys |
| outside | Sends data out |
| permission | {name} permission |
| always | Always |
| ask | Ask |
| never | Never |