[{"data":1,"prerenderedAt":878},["ShallowReactive",2],{"navigation_docs":3,"-concepts-permission-gate":504,"-concepts-permission-gate-surround":873},[4,28,51,187,214,469],{"title":5,"path":6,"stem":7,"children":8},"Get started","\u002Fget-started","1.get-started",[9,12,16,20,24],{"title":10,"path":6,"stem":11},"Overview","1.get-started\u002Findex",{"title":13,"path":14,"stem":15},"Why Kraft","\u002Fget-started\u002Fwhy-kraft","1.get-started\u002F0.why-kraft",{"title":17,"path":18,"stem":19},"Install","\u002Fget-started\u002Finstall","1.get-started\u002F1.install",{"title":21,"path":22,"stem":23},"Your first work item","\u002Fget-started\u002Ffirst-work-item","1.get-started\u002F2.first-work-item",{"title":25,"path":26,"stem":27},"FAQ","\u002Fget-started\u002Ffaq","1.get-started\u002F3.faq",{"title":29,"path":30,"stem":31,"children":32},"Concepts","\u002Fconcepts","2.concepts",[33,35,39,43,47],{"title":10,"path":30,"stem":34},"2.concepts\u002Findex",{"title":36,"path":37,"stem":38},"How a work item runs","\u002Fconcepts\u002Fhow-a-work-item-runs","2.concepts\u002F1.how-a-work-item-runs",{"title":40,"path":41,"stem":42},"Caps and budgets","\u002Fconcepts\u002Fcaps-and-budgets","2.concepts\u002F2.caps-and-budgets",{"title":44,"path":45,"stem":46},"Why a permission gate","\u002Fconcepts\u002Fpermission-gate","2.concepts\u002F3.permission-gate",{"title":48,"path":49,"stem":50},"Vocabulary","\u002Fconcepts\u002Fvocabulary","2.concepts\u002F4.vocabulary",{"title":52,"path":53,"stem":54,"children":55},"Guides","\u002Fguides","3.guides",[56,58,96,113,134,183],{"title":10,"path":53,"stem":57},"3.guides\u002Findex",{"title":59,"path":60,"stem":61,"children":62,"page":95},"Day to day","\u002Fguides\u002Fday-to-day","3.guides\u002F1.day-to-day",[63,67,71,75,79,83,87,91],{"title":64,"path":65,"stem":66},"The setup wizard on first start","\u002Fguides\u002Fday-to-day\u002Ffirst-run","3.guides\u002F1.day-to-day\u002F2.first-run",{"title":68,"path":69,"stem":70},"File a work item","\u002Fguides\u002Fday-to-day\u002Ffile-a-work-item","3.guides\u002F1.day-to-day\u002F3.file-a-work-item",{"title":72,"path":73,"stem":74},"Use Kraft from your agent","\u002Fguides\u002Fday-to-day\u002Fagent-integration","3.guides\u002F1.day-to-day\u002F4.agent-integration",{"title":76,"path":77,"stem":78},"Reviewing a change","\u002Fguides\u002Fday-to-day\u002Freview-a-change","3.guides\u002F1.day-to-day\u002F5.review-a-change",{"title":80,"path":81,"stem":82},"Raise a cap on a stopped item","\u002Fguides\u002Fday-to-day\u002Fraise-a-cap","3.guides\u002F1.day-to-day\u002F6.raise-a-cap",{"title":84,"path":85,"stem":86},"Kraft for VS Code","\u002Fguides\u002Fday-to-day\u002Fvscode","3.guides\u002F1.day-to-day\u002F7.vscode",{"title":88,"path":89,"stem":90},"Kraft on a phone","\u002Fguides\u002Fday-to-day\u002Fkraft-on-a-phone","3.guides\u002F1.day-to-day\u002F8.kraft-on-a-phone",{"title":92,"path":93,"stem":94},"Get notified when an item needs you","\u002Fguides\u002Fday-to-day\u002Fnotifications","3.guides\u002F1.day-to-day\u002F9.notifications",false,{"title":97,"path":98,"stem":99,"children":100,"page":95},"Customize and automate","\u002Fguides\u002Fcustomize","3.guides\u002F2.customize",[101,105,109],{"title":102,"path":103,"stem":104},"Write your own chain","\u002Fguides\u002Fcustomize\u002Fwrite-your-own-chain","3.guides\u002F2.customize\u002F1.write-your-own-chain",{"title":106,"path":107,"stem":108},"Add a security review or a gate reviewer","\u002Fguides\u002Fcustomize\u002Fadd-review-agents","3.guides\u002F2.customize\u002F2.add-review-agents",{"title":110,"path":111,"stem":112},"Schedule or webhook work","\u002Fguides\u002Fcustomize\u002Fschedule-and-webhook-work","3.guides\u002F2.customize\u002F3.schedule-and-webhook-work",{"title":114,"path":115,"stem":116,"children":117,"page":95},"Agents and harnesses","\u002Fguides\u002Fharnesses","3.guides\u002F3.harnesses",[118,122,126,130],{"title":119,"path":120,"stem":121},"Switch a task to another harness","\u002Fguides\u002Fharnesses\u002Fswitch-harness","3.guides\u002F3.harnesses\u002F1.switch-harness",{"title":123,"path":124,"stem":125},"Add or override a harness","\u002Fguides\u002Fharnesses\u002Fadding-a-harness","3.guides\u002F3.harnesses\u002F2.adding-a-harness",{"title":127,"path":128,"stem":129},"Build a worker Kit","\u002Fguides\u002Fharnesses\u002Fworker-kit","3.guides\u002F3.harnesses\u002F3.worker-kit",{"title":131,"path":132,"stem":133},"Give a worker its login","\u002Fguides\u002Fharnesses\u002Fgive-a-worker-its-login","3.guides\u002F3.harnesses\u002F4.give-a-worker-its-login",{"title":135,"path":136,"stem":137,"children":138,"page":95},"Run the server","\u002Fguides\u002Frun","3.guides\u002F4.run",[139,143,147,151,155,159,163,167,171,175,179],{"title":140,"path":141,"stem":142},"Remote access","\u002Fguides\u002Frun\u002Fremote-access","3.guides\u002F4.run\u002F01.remote-access",{"title":144,"path":145,"stem":146},"Put a proxy in front of Kraft","\u002Fguides\u002Frun\u002Fput-a-proxy-in-front-of-kraft","3.guides\u002F4.run\u002F02.put-a-proxy-in-front-of-kraft",{"title":148,"path":149,"stem":150},"Restart Kraft without ending running agents","\u002Fguides\u002Frun\u002Frestart-kraft","3.guides\u002F4.run\u002F03.restart-kraft",{"title":152,"path":153,"stem":154},"Back up and restore the database","\u002Fguides\u002Frun\u002Fback-up-and-restore","3.guides\u002F4.run\u002F04.back-up-and-restore",{"title":156,"path":157,"stem":158},"Logs and disk space","\u002Fguides\u002Frun\u002Flogs-and-disk-space","3.guides\u002F4.run\u002F05.logs-and-disk-space",{"title":160,"path":161,"stem":162},"Run Kraft as a service","\u002Fguides\u002Frun\u002Frun-as-a-service","3.guides\u002F4.run\u002F06.run-as-a-service",{"title":164,"path":165,"stem":166},"Upgrade Kraft","\u002Fguides\u002Frun\u002Fupgrade-kraft","3.guides\u002F4.run\u002F07.upgrade-kraft",{"title":168,"path":169,"stem":170},"Upgrade your configuration","\u002Fguides\u002Frun\u002Fupgrade-your-configuration","3.guides\u002F4.run\u002F08.upgrade-your-configuration",{"title":172,"path":173,"stem":174},"Upgrade from 1.4","\u002Fguides\u002Frun\u002Fupgrade-from-1-4","3.guides\u002F4.run\u002F09.upgrade-from-1-4",{"title":176,"path":177,"stem":178},"Upgrade from 0.x or a release candidate","\u002Fguides\u002Frun\u002Fupgrade-from-0-x-or-a-release-candidate","3.guides\u002F4.run\u002F10.upgrade-from-0-x-or-a-release-candidate",{"title":180,"path":181,"stem":182},"Roll back to 1.4","\u002Fguides\u002Frun\u002Froll-back","3.guides\u002F4.run\u002F11.roll-back",{"title":184,"path":185,"stem":186},"Kraft Lite","\u002Fguides\u002Fkraft-lite","3.guides\u002F5.kraft-lite",{"title":188,"path":189,"stem":190,"children":191},"Troubleshooting","\u002Ftroubleshooting","4.troubleshooting",[192,194,198,202,206,210],{"title":10,"path":189,"stem":193},"4.troubleshooting\u002Findex",{"title":195,"path":196,"stem":197},"Why did my item stop?","\u002Ftroubleshooting\u002Fwhy-did-my-item-stop","4.troubleshooting\u002F1.why-did-my-item-stop",{"title":199,"path":200,"stem":201},"Stop reasons in detail","\u002Ftroubleshooting\u002Fstop-reasons-in-detail","4.troubleshooting\u002F2.stop-reasons-in-detail",{"title":203,"path":204,"stem":205},"Starting and reaching Kraft","\u002Ftroubleshooting\u002Fstarting-and-reaching-kraft","4.troubleshooting\u002F3.starting-and-reaching-kraft",{"title":207,"path":208,"stem":209},"Doctor failures","\u002Ftroubleshooting\u002Fdoctor-failures","4.troubleshooting\u002F4.doctor-failures",{"title":211,"path":212,"stem":213},"Sandbox and Kit stops","\u002Ftroubleshooting\u002Fsandbox-and-kit-stops","4.troubleshooting\u002F5.sandbox-and-kit-stops",{"title":215,"path":216,"stem":217,"children":218},"Reference","\u002Freference","5.reference",[219,221,259,281,285,375,393,419,423,427,461,465],{"title":10,"path":216,"stem":220},"5.reference\u002Findex",{"title":222,"path":223,"stem":224,"children":225},"Web UI","\u002Freference\u002Fweb-ui","5.reference\u002F00.web-ui\u002Findex",[226,227,231,235,239,243,247,251,255],{"title":10,"path":223,"stem":224},{"title":228,"path":229,"stem":230},"Sidebar, search, and keyboard","\u002Freference\u002Fweb-ui\u002Fsidebar-search-and-keyboard","5.reference\u002F00.web-ui\u002F0.sidebar-search-and-keyboard",{"title":232,"path":233,"stem":234},"The board","\u002Freference\u002Fweb-ui\u002Fboard","5.reference\u002F00.web-ui\u002F1.board",{"title":236,"path":237,"stem":238},"An item's page","\u002Freference\u002Fweb-ui\u002Fitem-page","5.reference\u002F00.web-ui\u002F2.item-page",{"title":240,"path":241,"stem":242},"Fix loops and test scopes","\u002Freference\u002Fweb-ui\u002Ffix-loops-and-test-scopes","5.reference\u002F00.web-ui\u002F3.fix-loops-and-test-scopes",{"title":244,"path":245,"stem":246},"Config before an item starts","\u002Freference\u002Fweb-ui\u002Fconfig-before-start","5.reference\u002F00.web-ui\u002F4.config-before-start",{"title":248,"path":249,"stem":250},"The review page","\u002Freference\u002Fweb-ui\u002Freview-page","5.reference\u002F00.web-ui\u002F5.review-page",{"title":252,"path":253,"stem":254},"Templates and Settings","\u002Freference\u002Fweb-ui\u002Ftemplates-and-settings","5.reference\u002F00.web-ui\u002F6.templates-and-settings",{"title":256,"path":257,"stem":258},"Analytics","\u002Freference\u002Fweb-ui\u002Fanalytics","5.reference\u002F00.web-ui\u002F7.analytics",{"title":260,"path":261,"stem":262,"children":263},"CLI","\u002Freference\u002Fcli","5.reference\u002F01.cli\u002Findex",[264,265,269,273,277],{"title":10,"path":261,"stem":262},{"title":266,"path":267,"stem":268},"Item verbs","\u002Freference\u002Fcli\u002Fitem","5.reference\u002F01.cli\u002F2.item",{"title":270,"path":271,"stem":272},"View verbs","\u002Freference\u002Fcli\u002Fview","5.reference\u002F01.cli\u002F3.view",{"title":274,"path":275,"stem":276},"Repo verbs","\u002Freference\u002Fcli\u002Frepo","5.reference\u002F01.cli\u002F4.repo",{"title":278,"path":279,"stem":280},"Admin verbs","\u002Freference\u002Fcli\u002Fadmin","5.reference\u002F01.cli\u002F5.admin",{"title":282,"path":283,"stem":284},"Work item statuses","\u002Freference\u002Fstatuses","5.reference\u002F02.statuses",{"title":286,"path":287,"stem":288,"children":289},"Configuration","\u002Freference\u002Fconfiguration","5.reference\u002F03.configuration\u002Findex",[290,291,309,313,317,321,325,329,333,337,371],{"title":10,"path":287,"stem":288},{"title":292,"path":293,"stem":294,"children":295},"repos.yaml","\u002Freference\u002Fconfiguration\u002Frepos","5.reference\u002F03.configuration\u002F02.repos\u002Findex",[296,297,301,305],{"title":10,"path":293,"stem":294},{"title":298,"path":299,"stem":300},"How connect proposes commands","\u002Freference\u002Fconfiguration\u002Frepos\u002Fconnect-proposals","5.reference\u002F03.configuration\u002F02.repos\u002F1.connect-proposals",{"title":302,"path":303,"stem":304},"detectors.yaml","\u002Freference\u002Fconfiguration\u002Frepos\u002Fdetectors","5.reference\u002F03.configuration\u002F02.repos\u002F2.detectors",{"title":306,"path":307,"stem":308},"Workspaces","\u002Freference\u002Fconfiguration\u002Frepos\u002Fworkspaces","5.reference\u002F03.configuration\u002F02.repos\u002F3.workspaces",{"title":310,"path":311,"stem":312},"policy.yaml","\u002Freference\u002Fconfiguration\u002Fpolicy","5.reference\u002F03.configuration\u002F03.policy",{"title":314,"path":315,"stem":316},"Library and chains","\u002Freference\u002Fconfiguration\u002Flibrary-and-chains","5.reference\u002F03.configuration\u002F04.library-and-chains",{"title":318,"path":319,"stem":320},"harnesses.yaml","\u002Freference\u002Fconfiguration\u002Fharnesses-file","5.reference\u002F03.configuration\u002F05.harnesses-file",{"title":322,"path":323,"stem":324},"access.yaml","\u002Freference\u002Fconfiguration\u002Faccess","5.reference\u002F03.configuration\u002F06.access",{"title":326,"path":327,"stem":328},"intake.yaml","\u002Freference\u002Fconfiguration\u002Fintake","5.reference\u002F03.configuration\u002F07.intake",{"title":330,"path":331,"stem":332},"notify.yaml","\u002Freference\u002Fconfiguration\u002Fnotify","5.reference\u002F03.configuration\u002F08.notify",{"title":334,"path":335,"stem":336},"theme.yaml","\u002Freference\u002Fconfiguration\u002Ftheme","5.reference\u002F03.configuration\u002F09.theme",{"title":338,"path":339,"stem":340,"children":341},"Sandboxed workers","\u002Freference\u002Fconfiguration\u002Fsandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002Findex",[342,343,347,351,355,359,363,367],{"title":10,"path":339,"stem":340},{"title":344,"path":345,"stem":346},"Resource limits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fresource-limits","5.reference\u002F03.configuration\u002F10.sandbox\u002F1.resource-limits",{"title":348,"path":349,"stem":350},"Callbacks from a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcallbacks","5.reference\u002F03.configuration\u002F10.sandbox\u002F2.callbacks",{"title":352,"path":353,"stem":354},"Network policy","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fnetwork-policy","5.reference\u002F03.configuration\u002F10.sandbox\u002F3.network-policy",{"title":356,"path":357,"stem":358},"Credentials","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcredentials","5.reference\u002F03.configuration\u002F10.sandbox\u002F4.credentials",{"title":360,"path":361,"stem":362},"Kits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fkits","5.reference\u002F03.configuration\u002F10.sandbox\u002F5.kits",{"title":364,"path":365,"stem":366},"sandbox.yaml","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fsandbox-yaml","5.reference\u002F03.configuration\u002F10.sandbox\u002F6.sandbox-yaml",{"title":368,"path":369,"stem":370},"Git in a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fgit-in-a-sandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002F7.git-in-a-sandbox",{"title":372,"path":373,"stem":374},"Environment variables","\u002Freference\u002Fconfiguration\u002Fenvironment-variables","5.reference\u002F03.configuration\u002F11.environment-variables",{"title":376,"path":377,"stem":378,"children":379},"Chain file keys","\u002Freference\u002Fchain-nodes","5.reference\u002F04.chain-nodes\u002Findex",[380,381,385,389],{"title":10,"path":377,"stem":378},{"title":382,"path":383,"stem":384},"Subprocess tasks","\u002Freference\u002Fchain-nodes\u002Fsubprocess-tasks","5.reference\u002F04.chain-nodes\u002F2.subprocess-tasks",{"title":386,"path":387,"stem":388},"Fix loop and judge","\u002Freference\u002Fchain-nodes\u002Ffix-loop","5.reference\u002F04.chain-nodes\u002F3.fix-loop",{"title":390,"path":391,"stem":392},"Result file","\u002Freference\u002Fchain-nodes\u002Fresult-file","5.reference\u002F04.chain-nodes\u002F4.result-file",{"title":394,"path":395,"stem":396,"children":397},"Agent harnesses","\u002Freference\u002Fharnesses","5.reference\u002F05.harnesses\u002Findex",[398,399,403,407,411,415],{"title":10,"path":395,"stem":396},{"title":400,"path":401,"stem":402},"Unattended runs","\u002Freference\u002Fharnesses\u002Funattended-runs","5.reference\u002F05.harnesses\u002F2.unattended-runs",{"title":404,"path":405,"stem":406},"Agent profiles","\u002Freference\u002Fharnesses\u002Fagent-profiles","5.reference\u002F05.harnesses\u002F3.agent-profiles",{"title":408,"path":409,"stem":410},"Harness definition files","\u002Freference\u002Fharnesses\u002Fharness-files","5.reference\u002F05.harnesses\u002F4.harness-files",{"title":412,"path":413,"stem":414},"Fallback and escalation","\u002Freference\u002Fharnesses\u002Ffallback-and-escalation","5.reference\u002F05.harnesses\u002F5.fallback-and-escalation",{"title":416,"path":417,"stem":418},"Cost reporting","\u002Freference\u002Fharnesses\u002Fcost-reporting","5.reference\u002F05.harnesses\u002F6.cost-reporting",{"title":420,"path":421,"stem":422},"Permission gate","\u002Freference\u002Fpermissions","5.reference\u002F06.permissions",{"title":424,"path":425,"stem":426},"Inbound triggers","\u002Freference\u002Ftriggers","5.reference\u002F07.triggers",{"title":428,"path":429,"stem":430,"children":431},"HTTP API","\u002Freference\u002Fhttp-api","5.reference\u002F08.http-api\u002Findex",[432,433,437,441,445,449,453,457],{"title":10,"path":429,"stem":430},{"title":434,"path":435,"stem":436},"Filing, reading and changing work items","\u002Freference\u002Fhttp-api\u002Fwork-items","5.reference\u002F08.http-api\u002F2.work-items",{"title":438,"path":439,"stem":440},"Gates, run control, ending and retry","\u002Freference\u002Fhttp-api\u002Fgates-run-control-and-ending","5.reference\u002F08.http-api\u002F3.gates-run-control-and-ending",{"title":442,"path":443,"stem":444},"The work item object","\u002Freference\u002Fhttp-api\u002Fwork-item-object","5.reference\u002F08.http-api\u002F4.work-item-object",{"title":446,"path":447,"stem":448},"Budget, events, diff and documents","\u002Freference\u002Fhttp-api\u002Fbudget-and-events","5.reference\u002F08.http-api\u002F5.budget-and-events",{"title":450,"path":451,"stem":452},"Repos, chains, harnesses and the server","\u002Freference\u002Fhttp-api\u002Frepos-chains-harnesses-and-server","5.reference\u002F08.http-api\u002F6.repos-chains-harnesses-and-server",{"title":454,"path":455,"stem":456},"Drafts","\u002Freference\u002Fhttp-api\u002Fdrafts","5.reference\u002F08.http-api\u002F7.drafts",{"title":458,"path":459,"stem":460},"Ops for each draft area","\u002Freference\u002Fhttp-api\u002Fdraft-ops","5.reference\u002F08.http-api\u002F8.draft-ops",{"title":462,"path":463,"stem":464},"MCP tools","\u002Freference\u002Fmcp-tools","5.reference\u002F09.mcp-tools",{"title":466,"path":467,"stem":468},"Events","\u002Freference\u002Fevents","5.reference\u002F10.events",{"title":470,"path":471,"stem":472,"children":473},"Security and project","\u002Fproject","6.project",[474,476,480,484,488,492,496,500],{"title":10,"path":471,"stem":475},"6.project\u002Findex",{"title":477,"path":478,"stem":479},"Security","\u002Fproject\u002Fsecurity","6.project\u002F1.security",{"title":481,"path":482,"stem":483},"Data and privacy","\u002Fproject\u002Fdata-and-privacy","6.project\u002F2.data-and-privacy",{"title":485,"path":486,"stem":487},"What's new in 2.0","\u002Fproject\u002Fwhats-new","6.project\u002F3.whats-new",{"title":489,"path":490,"stem":491},"Status and support","\u002Fproject\u002Fstatus-and-support","6.project\u002F4.status-and-support",{"title":493,"path":494,"stem":495},"Architecture","\u002Fproject\u002Farchitecture","6.project\u002F5.architecture",{"title":497,"path":498,"stem":499},"Source map","\u002Fproject\u002Fsource-map","6.project\u002F6.source-map",{"title":501,"path":502,"stem":503},"Contributing","\u002Fproject\u002Fcontributing","6.project\u002F7.contributing",{"id":505,"title":44,"body":506,"description":866,"extension":867,"links":868,"meta":869,"navigation":870,"path":45,"seo":871,"stem":46,"__hash__":872},"docs\u002F2.concepts\u002F3.permission-gate.md",{"type":507,"value":508,"toc":856},"minimark",[509,527,549,557,562,565,569,572,575,607,615,619,622,687,693,702,705,727,733,744,758,767,783,787,798,802,816,834,838],[510,511,512,513,518,519,523,524,526],"p",{},"A Kraft ",[514,515,517],"a",{"href":516},"\u002Fconcepts\u002Fvocabulary#worker","worker"," runs with nobody watching, so a permission prompt has nobody to\nanswer it. This page explains why Kraft answers those prompts itself, and why\nit does that differently for each ",[514,520,522],{"href":521},"\u002Fconcepts\u002Fvocabulary#harness","harness",". For\nwhat the gate does and how to configure it, see\n",[514,525,420],{"href":421},".",[510,528,529,530,534,535,538,539,543,544,548],{},"A ",[531,532,533],"strong",{},"permission prompt"," is the agent CLI asking whether it may run one tool\ncall, such as a shell command or a file edit. The ",[531,536,537],{},"gate"," is Kraft's answer to\nit: the CLI asks, Kraft decides from the task's ",[514,540,542],{"href":541},"\u002Fconcepts\u002Fvocabulary#policy","policy",", and the decision lands\non the ",[514,545,547],{"href":546},"\u002Fconcepts\u002Fvocabulary#work-item","work item","'s timeline.",[510,550,551],{},[552,553],"img",{"alt":554,"src":555,"width":556},"One tool call through the permission gate: left to the CLI, a prompt goes to a person nobody is watching. On Claude Code, Cursor and Codex the CLI asks Kraft instead, and Kraft's gate decides from the task's allowed_tools, deny_tools and grants: allow or deny, each recorded as a permission_decision on the work item's timeline, or, on Cursor and Codex with no allowed_tools, no opinion, which leaves the decision to the CLI and logs nothing","\u002Fdiagrams\u002Fportrait\u002Fpermission-gate.svg",431,[558,559,561],"h2",{"id":560},"the-problem-with-an-unattended-prompt","The problem with an unattended prompt",[510,563,564],{},"Left to a harness's own judgment, an unattended agent does one of two things.\nIt stalls on a tool it is unsure about, or it runs the tool anyway because\nnobody is watching. Neither is acceptable when you want to know what a worker\nwas allowed to do.",[558,566,568],{"id":567},"the-third-option","The third option",[510,570,571],{},"Kraft's permission gate is a third option. The worker asks Kraft, Kraft\nanswers from the task's own policy, and the answer, allow or deny and why,\nlands on the work item's timeline. You do not have to watch a session to know\nwhat it was let do.",[510,573,574],{},"The policy comes from three lists, which you set at any layer from the\nrepository down to the task:",[576,577,578,586,592],"ul",{},[579,580,581,585],"li",{},[582,583,584],"code",{},"allowed_tools",", the tools a task may use;",[579,587,588,591],{},[582,589,590],{},"deny_tools",", the tools it may not; and",[579,593,594,597,598,601,602,606],{},[582,595,596],{},"grants",", named operations such as ",[582,599,600],{},"git-push"," that a task may run (see\n",[514,603,605],{"href":604},"\u002Fconcepts\u002Fvocabulary#grant","Grant",").",[510,608,609,610,614],{},"See ",[514,611,613],{"href":612},"\u002Fconcepts\u002Fcaps-and-budgets#how-a-policy-resolves","How a policy resolves","\nfor how those layers combine.",[558,616,618],{"id":617},"why-it-works-differently-per-harness","Why it works differently per harness",[510,620,621],{},"The gate has to meet each CLI where that CLI offers a hook. The harnesses\ndiffer, so Kraft uses the strongest mechanism each one has.",[623,624,625,641],"table",{},[626,627,628],"thead",{},[629,630,631,635,638],"tr",{},[632,633,634],"th",{},"Harness",[632,636,637],{},"What Kraft uses",[632,639,640],{},"Reaches the gate",[642,643,644,656,666,677],"tbody",{},[629,645,646,650,653],{},[647,648,649],"td",{},"Claude Code",[647,651,652],{},"Its permission prompt tool, pointed at Kraft",[647,654,655],{},"Yes",[629,657,658,661,664],{},[647,659,660],{},"Cursor, Codex",[647,662,663],{},"A hook Kraft installs, run before every tool call",[647,665,655],{},[629,667,668,671,674],{},[647,669,670],{},"OpenCode, Amp",[647,672,673],{},"The task's lists, written into the CLI's own permission rules",[647,675,676],{},"No",[629,678,679,682,685],{},[647,680,681],{},"Gemini, Antigravity",[647,683,684],{},"Nothing: the CLI runs in its most permissive mode",[647,686,676],{},[510,688,689,692],{},[514,690,420],{"href":691},"\u002Freference\u002Fpermissions#which-harnesses-reach-the-gate"," has\nthe full table. The rest of this section says why each row is what it is.",[510,694,695,697,698,701],{},[531,696,649],{}," settles most tool calls itself with its own\n",[514,699,700],{"href":401},"classifier",", such as a read-only shell\ncommand or a routine edit. What it will not settle, it hands\nto a permission prompt tool. Kraft points that at its own tool, so the CLI\ncalls into Kraft instead of prompting a person who is not there.",[510,703,704],{},"How much reaches the gate follows from Claude's permission mode:",[576,706,707,717],{},[579,708,709,710,712,713,716],{},"With no ",[582,711,584],{},", Claude runs in ",[582,714,715],{},"auto",", and the gate sees only what the\nclassifier declines to settle.",[579,718,719,720,722,723,726],{},"With an ",[582,721,584],{}," list, Claude switches to\n",[582,724,725],{},"manual",", and every call the built-in allowlist does not cover reaches the\ngate.",[510,728,729,730,732],{},"An ",[582,731,584],{}," list is what makes the gate worth configuring.",[510,734,735,738,739,743],{},[531,736,737],{},"Cursor and Codex"," have no prompt tool, but each runs a hook before every\ntool call. Kraft installs a hook that asks the same gate. Kraft scopes the\nhook to the launch: Cursor's is written into the ",[514,740,742],{"href":741},"\u002Fconcepts\u002Fvocabulary#worktree","worktree"," and kept out of your\ncommits, and Codex's is passed per launch and trusted by hash, never by\nbypassing Codex's hook trust, since that would trust every hook a repository\nships.",[510,745,746,749,750,753,754,757],{},[531,747,748],{},"Gemini and Antigravity"," have no hook Kraft can use and no way to enforce a\ntool list. Gemini runs with ",[582,751,752],{},"--approval-mode yolo"," and Antigravity with\n",[582,755,756],{},"--dangerously-skip-permissions",", so their calls never reach the gate.",[510,759,760,761,763,764,766],{},"In a stricter mode, each one would silently deny the calls a worker needs, such\nas a shell command, because nobody is there to approve them. A task that sets\n",[582,762,590],{}," or ",[582,765,584],{}," refuses to launch on either one instead of\nrunning with a policy it cannot keep.",[510,768,769,772,773,775,776,778,779,782],{},[531,770,771],{},"OpenCode and Amp"," offer no reliable per-call hook. Kraft writes the task's\n",[582,774,590],{}," and ",[582,777,584],{}," into the CLI's own permission configuration\nfor that one launch, and the CLI enforces them itself. The trade-off is that\nthese calls never reach the gate, so they leave no ",[582,780,781],{},"permission_decision"," on\nthe timeline.",[558,784,786],{"id":785},"why-a-deny-is-final-but-an-allow-may-not-be","Why a deny is final but an allow may not be",[510,788,789,790,793,794,797],{},"Kraft can only decide; the CLI still runs the call. A deny is a deny on every\nharness. An allow is the gate's decision, and on Cursor it does not override\nthe CLI's own ",[582,791,792],{},"--auto-review"," classifier, so a call the gate allows can still\nbe refused. This is why ",[514,795,596],{"href":796},"\u002Freference\u002Fpermissions#grants"," are described\nas the gate's decision and not a guarantee that a command will run.",[558,799,801],{"id":800},"why-grants-are-names-not-command-patterns","Why grants are names, not command patterns",[510,803,804,805,807,808,811,812,815],{},"A grant such as ",[582,806,600],{}," is a named operation, not a pattern like\n",[582,809,810],{},"git push *",". A pattern also matches ",[582,813,814],{},"git push x; rm -rf y",". Kraft's grant\nmatcher accepts only a call that is exactly one plain git invocation of the\ngranted subcommand, and refuses anything that could run something else. That\nis also why grants are not written into OpenCode's or Amp's rules, where only a\npattern is available.",[510,817,729,818,822,823,826,827,830,831,833],{},[514,819,821],{"href":820},"\u002Fconcepts\u002Fvocabulary#escalation-turn","escalation turn"," holds ",[582,824,825],{},"git-commit",",\n",[582,828,829],{},"git-rebase",", and ",[582,832,600],{}," unless you narrow it, because an escalation that\nrebased the branch has to push it. A gate's reviewer gets no such default.",[558,835,837],{"id":836},"related","Related",[576,839,840,845,850],{},[579,841,842,844],{},[514,843,420],{"href":421},": what the gate does per harness and how to configure it.",[579,846,847,849],{},[514,848,400],{"href":401},": how each harness runs when nobody can answer a prompt.",[579,851,852,855],{},[514,853,477],{"href":854},"\u002Fproject\u002Fsecurity#default-posture",": the default posture this page leads up to.",{"title":857,"searchDepth":858,"depth":858,"links":859},"",2,[860,861,862,863,864,865],{"id":560,"depth":858,"text":561},{"id":567,"depth":858,"text":568},{"id":617,"depth":858,"text":618},{"id":785,"depth":858,"text":786},{"id":800,"depth":858,"text":801},{"id":836,"depth":858,"text":837},"Why Kraft answers a worker's permission prompts itself, and how each harness lets it.","md",null,{},true,{"title":44,"description":866},"ei5WbCdsxC5EEMStHEpILH6NFEZgIFMTy8DKmqeOqKA",[874,876],{"title":40,"path":41,"stem":42,"description":875,"children":-1},"How Kraft bounds time, tokens, and dollars, why a raise is bounded, and how a policy resolves from policy.yaml down to a single task.",{"title":48,"path":49,"stem":50,"description":877,"children":-1},"What each Kraft term means, from work item, chain, node, task, gate and cap to harness, sandbox, worktree and escalation turn.",1791801248256]