GPS 2 Permission

GPS-2 · Permission & Capability

Answers: what may this agent actually do?

Most agent incidents are permission incidents: the agent sent the email, ran the destructive command, published the post. GPS-2 moves the check before the action, not after the damage.

The five invariants

ID	Requirement
GPS-2.1	Deny-by-default — anything not explicitly allowed is denied; explicit deny beats allow
GPS-2.2	Pre-execution — the gate runs before the tool call, never after
GPS-2.3	Irreversible ⇒ human — a reversible: false action needs an explicit grant and a passed human gate, or it is denied/escalated
GPS-2.4	Every decision logged — ALLOW, DENY, and ESCALATE all write to audit
GPS-2.5	No self-widening — only the governance layer edits grants; an agent editing its own permissions is a constitutional violation

The decision object

The gate emits a verdict, not a boolean — so the reason survives into the audit log:

ALLOW     — in an explicit allow scope
DENY      — unlisted (default), or explicitly denied
ESCALATE  — irreversible and no human gate passed yet

Unknown actions are treated as irreversible, not as harmless. Uncertainty resolves toward caution.

Why self-widening is the cardinal sin

GPS-2.5 is what separates a governed system from a merely permissioned one. If an agent can edit its own grants, every other permission invariant is decorative — it can simply grant itself what it was denied. This is why permissions live in the governance layer (GOS-0 Constitution), not with the actor.

Verify it

cd reference/python && python conformance_test.py
#   ✅ inv1: unlisted action denied
#   ✅ explicit deny -> DENY
#   ✅ inv3: publish escalates without human
#   ✅ inv3: publish allowed with human gate
#   ✅ unknown action treated as irreversible

⚠️ GPS-2.2, GPS-2.4, and GPS-2.5 are attestation requirements — call ordering, audit completeness, and the grant-editing path are properties of your integration, not provable by an in-process suite. See Conformance §5.2.

---

📖 Spec: spec/GPS-2-permission.md → Next: GOP-3 Orchestration