permission-intersection
Effective permissions of a delegated agent: requested ∩ user ∩ parent, minus explicit denials — Computes what a sub-agent may actually do: the permissions it requested, intersected with what the end user holds and what its parent agent holds, minus any explicit deny list, and says for each denied permission which party lacks it. Permission names are compared exactly (no wildcards); caller-declared implications (for example 'admin' grants 'read') can be given and are expanded transitively wit
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"requested": "<requested>",
"user": "<user>",
"parent": "<parent>"
},
"name": "permission-intersection"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| user | Yes | Permissions held by the end user. | |
| denied | No | Explicit denials; they win over any grant. | |
| parent | Yes | Permissions held by the delegating agent. | |
| implies | No | ||
| requested | Yes | Permissions the delegate asks for. |