requires on an action
requires <capability.path> names the capability needed to run the
action — a dotted identifier path (account.delete), not a string. It’s
checked independently by both .verify() and .commit() — see
Actions.
policy: allow / policy: deny
Default is allow
This is a deliberate choice, not an oversight. It keeps ordinary scripts — and any action with norequires clause at all — completely unaffected;
only an action that explicitly names a capability can ever be denied, and
only once some policy in scope actually says so. A stricter default-deny
mode — an agent gets nothing unless explicitly granted, preventing it
from becoming an unrestricted process — is real future work, tracked on
the Roadmap — not the default today.
Scoping matches delegation exactly
Environment, resolved by walking the parent chain —
the identical mechanism delegation uses. A policy:
block inside a session or agent can grant or revoke a capability
without affecting the surrounding scope, and the change is invisible once
you’re back outside it. There’s nothing session/agent-specific about the
implementation; it’s the same “each scope has its own optional override”
rule variables themselves follow.
What this doesn’t cover yet
Capability dimensions beyond a name
Capability dimensions beyond a name
A fuller capability model is possible — cost, risk, side effects,
authentication, scope, rate limits. Today a capability is just a
dotted path with an allow/deny bit.
Enforcement on what an action's body goes on to call
Enforcement on what an action's body goes on to call
requires only gates entering the action itself — a bare function
call inside the body has no capability check of its own. Wrap that
call in a tool instead and it gets checked too;
see Tool: closing the gap.Static/compile-time checking
Static/compile-time checking
All checks happen at
.verify()/.commit() runtime, consistent with the
rest of Sense’s shallow, runtime-only type/annotation checking so far.Continue
Actions
The full prepare → verify → commit model this gates.
Roadmap
Everything above, tracked with reasons, not just a checklist.