Nobody Is There to Say Yes: Writing Unified Permissions as an Unattended Contract

Writing the policy as a single manifest

The contract lives outside the code, as a declaration. Fold it into the agent's instructions and it gets carried along by context on every edit, loosening before you notice. I put it in its own file so every change is traceable through git history.

# unattended-permission.yaml — the unattended contract (single source of truth)
version: 3
default: queue          # unclassified falls to hold (a gentle deny-by-default)
 
rules:
  # --- allow as-is (reversible, contained) ---
  - match: { action: fs.read }
    decision: allow
  - match: { action: fs.write, path_glob: "workspace/**" }
    decision: allow
  - match: { action: process.run, cmd_prefix: ["npm test", "npm run lint"] }
    decision: allow
 
  # --- let a human look once (hold) ---
  - match: { action: net.request, host_glob: "api.github.com" }
    decision: queue
  - match: { action: fs.write, path_glob: "content/**" }
    decision: queue
 
  # --- never touch unattended ---
  - match: { action: process.run, cmd_prefix: ["git push", "rm -rf", "npx wrangler deploy"] }
    decision: deny
  - match: { action: secret.read }
    decision: deny

default: queue is the pivot. Drop unknown operations to deny and legitimate work vanishes silently. Pass them through as allow and danger leaks. Fall to hold and the operation never runs, yet the evidence remains for a human to pick up the next morning. It keeps the safety of deny-by-default without losing the work.

Keep each rule at a granularity where it can explain why it decides as it does. That pays off later. A rule your six-months-from-now self cannot read is the first sign of loosening.

Recording the prompts that would have appeared

The most painful thing about an unattended run is not knowing what the agent tried to do and was stopped from doing. Interactively it stays on screen; unattended, the prompt itself never appears. So I write the decision down myself, at the moment the contract is consulted.

# permission_gate.py — consult the contract before running; record decision and reason
import json, time, fnmatch, sys, pathlib, yaml
 
POLICY = yaml.safe_load(pathlib.Path("unattended-permission.yaml").read_text())
AUDIT  = pathlib.Path("audit/permission-events.jsonl")
 
def classify(action: str, **attrs) -> tuple[str, dict | None]:
    for rule in POLICY["rules"]:
        m = rule["match"]
        if m.get("action") != action:
            continue
        ok = True
        for key, pat in m.items():
            if key == "action":
                continue
            val = attrs.get(key.replace("_glob", "").replace("_prefix", ""), "")
            if key.endswith("_glob") and not fnmatch.fnmatch(val, pat):
                ok = False
            if key.endswith("_prefix") and not any(val.startswith(p) for p in pat):
                ok = False
        if ok:
            return rule["decision"], rule
    return POLICY["default"], None  # unclassified -> default (queue)
 
def gate(action: str, **attrs) -> bool:
    decision, rule = classify(action, **attrs)
    AUDIT.parent.mkdir(exist_ok=True)
    with AUDIT.open("a") as f:
        f.write(json.dumps({
            "ts": time.strftime("%Y-%m-%dT%H:%M:%S"),
            "action": action, "attrs": attrs,
            "decision": decision,
            "matched": rule["match"] if rule else "default",
        }, ensure_ascii=False) + "\n")
    return decision == "allow"  # queue / deny do not execute here

gate() returns just one thing: may this run right now. Queue and deny are identical in that neither executes. The difference is the decision value in the audit log and how you treat it in the morning. That separation keeps the downstream design simple.

I made the audit log one event per line as JSONL because appends are safe and the morning roll-up is a grep and a few lines of script. Logs for unattended work need two things: not to corrupt on write, and to be light on read.

The next morning, this is where you look

Queuing things up is meaningless if you never go and look. I fold the previous night's decisions into a single digest that I open first thing.

# digest.py — fold last night's audit log into one sheet, grouped by decision
import json, collections, pathlib
 
events = [json.loads(l) for l in pathlib.Path("audit/permission-events.jsonl").read_text().splitlines()]
by = collections.defaultdict(list)
for e in events:
    by[e["decision"]].append(e)
 
print(f"# Permission decisions last night — {len(events)} total")
for d in ("queue", "deny", "allow"):
    items = by.get(d, [])
    print(f"\n## {d}: {len(items)}")
    for e in items[:20] if d != "allow" else []:
        print(f"- {e['ts']}  {e['action']}  {e['attrs']}")

It lists only queue and deny; allow is a count. Rereading everything an agent was permitted to do unattended is not realistic. What a human should see is the two things that matter: "held, waiting on your call" and "denied, the line the contract held." Once I could skim that in two or three minutes each morning, unattended operation finally felt sustainable.

For each queued item I decide whether to promote it into the contract or run it by hand once and be done. If the same operation lands in queue three nights running, that is the signal to move it to allow. The contract is not written once; it grows quietly out of the morning digest.

Thirty nights in, the numbers

This design is hard to trust on words alone, so here is what I measured. An indie developer app-maintenance job for one of my wallpaper apps — it touches AdMob remote config and asset sync — run under this contract for 30 consecutive nights.

The three that deny stopped were: one unintended git push, one rm -rf folded into a dependency swap, and one secret read. Interactively I would have reflexively refused all three. In the unattended hours, the contract made the same call for me. Small on paper — but if even one of those three had gone through, the nights spent recovering would have been far longer.

The queue median settling at four mattered too. If it were topping twenty every night, that would be a sign the contract is too vague, or that I am mixing in tasks that do not belong unattended at all. The volume of holds mirrors the resolution of your contract directly.

The order to introduce it, and the first line to draw

Trying to classify every operation at once will freeze you. I brought it in on an order.

Fix deny first, and narrowly: destructive production changes and secret reads. Those two, and only those, are never touched unattended. Close that first and you can fill in the rest slowly. Next make allow explicit, limited to what is reversible and contained — reads, worktree changes, running tests. Finally, leave the undecided alone. default: queue will catch it.

Put another way: fill in from the two ends you are sure of, and entrust the middle to hold. That was the quietest way I found to grow an unattended contract without letting it break.

Unified permissions gave us a place to state how far we allow. Make that statement writable not only as an interactive dialog during the hours a human is present, but as a contract for the hours no one is. That single step is what I most wanted to share today. If a nightly job of yours has ever stalled on a prompt, even once, I would gently suggest drawing just the deny line first. That is where I started, and it is how the mornings turned into a few quiet minutes. Thank you for reading.