Artifact: A Deny Rule Scoping Writes to One Subdirectory

A permission config that blocks an out-of-scope write, logged as denied -- exercises co-11.

{
  "permissions": {
    "allow": ["Edit(carrier_adapter/**)", "Read(**)"],
    "deny": ["Edit(**)", "Write(**)"]
  }
}

[agent] attempts: Edit(carrier_adapter/retry.py)
[harness] permission check: matches allow rule "Edit(carrier_adapter/**)" -- ALLOWED
 
[agent] attempts: Edit(shared_config/database.yml)
[harness] permission check: matches deny rule "Edit(**)"; no allow rule covers this path
[harness] BLOCKED and logged: denied -- Edit(shared_config/database.yml) is outside the
allowed scope carrier_adapter/**

Last updated July 17, 2026

Artifact: A Deny Rule Scoping Writes to One Subdirectory

Command Palette