{"id":"permission-intersection","title":"Effective permissions of a delegated agent: requested ∩ user ∩ parent, minus explicit denials","description":"Computes what a sub-agent may actually do: the permissions it requested, intersected with what the end user holds and what its parent agent holds, minus any explicit deny list, and says for each denied permission which party lacks it. Permission names are compared exactly (no wildcards); caller-declared implications (for example 'admin' grants 'read') can be given and are expanded transitively with cycles tolerated. fail when any requested permission is not granted (privilege escalation attempt: requested beyond the parent is marked); pass when all are. Does not authenticate anyone or know any permission model.","roi":"Stops a delegate from exercising a permission neither the user nor the parent agent had.","audience":"agent-infra","package":"execution-safety-kit","channels":["x402","mcp"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/permission-intersection","path":"/api/v1/permission-intersection","contentType":"application/json"},"price":{"amount":"0.005","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"required":["requested","user","parent"],"properties":{"requested":{"type":"array","maxItems":300,"items":{"type":"string","minLength":1,"maxLength":200},"description":"Permissions the delegate asks for.","minItems":1},"user":{"type":"array","maxItems":300,"items":{"type":"string","minLength":1,"maxLength":200},"description":"Permissions held by the end user."},"parent":{"type":"array","maxItems":300,"items":{"type":"string","minLength":1,"maxLength":200},"description":"Permissions held by the delegating agent."},"denied":{"type":"array","maxItems":300,"items":{"type":"string","minLength":1,"maxLength":200},"description":"Explicit denials; they win over any grant."},"implies":{"type":"array","maxItems":100,"items":{"type":"object","additionalProperties":false,"required":["permission","grants"],"properties":{"permission":{"type":"string","minLength":1,"maxLength":200},"grants":{"type":"array","minItems":1,"maxItems":50,"items":{"type":"string","minLength":1,"maxLength":200}}}}}}},"resultSchema":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"granted":{"type":"array","items":{"type":"string"}},"denied":{"type":"array","items":{"type":"object","properties":{"permission":{"type":"string"},"reason":{"type":"string","enum":["explicitly-denied","user-lacks","parent-lacks","user-and-parent-lack"]},"beyondParent":{"type":"boolean"}}}},"effective":{"type":"array","items":{"type":"string"},"description":"Everything the delegate could exercise including implied permissions, minus denials."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"granted":{"type":"array","items":{"type":"string"}},"denied":{"type":"array","items":{"type":"object","properties":{"permission":{"type":"string"},"reason":{"type":"string","enum":["explicitly-denied","user-lacks","parent-lacks","user-and-parent-lack"]},"beyondParent":{"type":"boolean"}}}},"effective":{"type":"array","items":{"type":"string"},"description":"Everything the delegate could exercise including implied permissions, minus denials."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"requested":["files:read","files:write","email:send"],"user":["files:read","files:write","email:send"],"parent":["files:read","email:send"],"denied":[]},"openapiOperation":{"operationId":"permission_intersection","summary":"Effective permissions of a delegated agent: requested ∩ user ∩ parent, minus explicit denials","description":"Computes what a sub-agent may actually do: the permissions it requested, intersected with what the end user holds and what its parent agent holds, minus any explicit deny list, and says for each denied permission which party lacks it. Permission names are compared exactly (no wildcards); caller-declared implications (for example 'admin' grants 'read') can be given and are expanded transitively with cycles tolerated. fail when any requested permission is not granted (privilege escalation attempt: requested beyond the parent is marked); pass when all are. Does not authenticate anyone or know any permission model.\n\nPrice: 0.005 USDC on Base (x402).","x-x402-price-usdc":"0.005","x-x402-amount":"5000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.005"}},"x-audience":"agent-infra","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/permission-intersection","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["requested","user","parent"],"properties":{"requested":{"type":"array","maxItems":300,"items":{"type":"string","minLength":1,"maxLength":200},"description":"Permissions the delegate asks for.","minItems":1},"user":{"type":"array","maxItems":300,"items":{"type":"string","minLength":1,"maxLength":200},"description":"Permissions held by the end user."},"parent":{"type":"array","maxItems":300,"items":{"type":"string","minLength":1,"maxLength":200},"description":"Permissions held by the delegating agent."},"denied":{"type":"array","maxItems":300,"items":{"type":"string","minLength":1,"maxLength":200},"description":"Explicit denials; they win over any grant."},"implies":{"type":"array","maxItems":100,"items":{"type":"object","additionalProperties":false,"required":["permission","grants"],"properties":{"permission":{"type":"string","minLength":1,"maxLength":200},"grants":{"type":"array","minItems":1,"maxItems":50,"items":{"type":"string","minLength":1,"maxLength":200}}}}}}},"example":{"requested":["files:read","files:write","email:send"],"user":["files:read","files:write","email:send"],"parent":["files:read","email:send"],"denied":[]}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"granted":{"type":"array","items":{"type":"string"}},"denied":{"type":"array","items":{"type":"object","properties":{"permission":{"type":"string"},"reason":{"type":"string","enum":["explicitly-denied","user-lacks","parent-lacks","user-and-parent-lack"]},"beyondParent":{"type":"boolean"}}}},"effective":{"type":"array","items":{"type":"string"},"description":"Everything the delegate could exercise including implied permissions, minus denials."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/permission-intersection/","docsJson":"https://agents.writerslogic.com/docs/permission-intersection.json","sample":"https://agents.writerslogic.com/api/v1/samples/permission-intersection","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}