Package com.tnsai.quality.security

Class ToolPermissionManager

java.lang.Object
com.tnsai.quality.security.ToolPermissionManager
public final class ToolPermissionManager extends Object
Manages per-tool permission levels using the 3-tier model.

Default permission for all tools is PermissionLevel.ASK (backward compatible with existing confirmation-based flows).

Usage


 ToolPermissionManager manager = new ToolPermissionManager();

 // Auto-execute safe tools
 manager.setToolPermission("search_web", PermissionLevel.ALWAYS);

 // Block destructive tools
 manager.setToolPermission("file_delete", PermissionLevel.DENY);

 // Check permission
 PermissionLevel level = manager.getPermission("file_delete");
 if (!level.allowsExecution()) {
     throw new SecurityException("Tool blocked");
 }
Since:
0.2.3

  • Constructor Details

    • ToolPermissionManager

      public ToolPermissionManager()
      Creates a manager with PermissionLevel.ASK as the default. Note: ASK allows execution — use defaultDeny() for secure-by-default.

    • ToolPermissionManager

      public ToolPermissionManager(PermissionLevel defaultLevel)
      Creates a manager with the specified default permission level.
      Parameters:
      defaultLevel - the default permission for tools without explicit configuration

  • Method Details

    • defaultDeny

      public static ToolPermissionManager defaultDeny()
      Creates a manager that denies unknown tools by default (secure-by-default). Only explicitly allowed tools will be executable.
      Returns:
      a deny-by-default permission manager

    • setToolPermission

      public void setToolPermission(String toolName, PermissionLevel level)
      Sets the permission level for a specific tool.
      Parameters:
      toolName - the tool name (case-insensitive via Locale.ROOT)
      level - the permission level

    • getPermission

      public PermissionLevel getPermission(String toolName)
      Gets the permission level for a tool. Returns the default level if no explicit permission is set.
      Parameters:
      toolName - the tool name
      Returns:
      the permission level

    • clearToolPermission

      public void clearToolPermission(String toolName)
      Removes any explicit permission for a tool, reverting to the default.
      Parameters:
      toolName - the tool name

    • isAllowed

      public boolean isAllowed(String toolName)
      Checks if tool execution is allowed (not DENY).
      Parameters:
      toolName - the tool name
      Returns:
      true if the tool is allowed to execute

    • requiresConfirmation

      public boolean requiresConfirmation(String toolName)
      Checks if tool requires confirmation.
      Parameters:
      toolName - the tool name
      Returns:
      true if confirmation is required

    • getDefaultLevel

      public PermissionLevel getDefaultLevel()
      Returns the default permission level.
      Returns:
      the default level

    • getAllPermissions

      public Map<String,PermissionLevel> getAllPermissions()
      Returns all explicit tool permissions (unmodifiable view).
      Returns:
      map of tool name to permission level

    • clearAll

      public void clearAll()
      Clears all explicit tool permissions, reverting everything to default.