Tool Access Grants

• Status: Todo
• Kind: Feature
• Authors: Jean Mertz git@jeanmertz.com
• Date: 2026-09-10
• Implements: 076
• Label: type=tracking

Tracking ticket for RFD 076.

Implementation plan

• Add access policy types and evaluation to jp_tool: Introduces AccessPolicy, FsRule, NetRule, EnvRule, and FsAccessError, plus the path-canonicalization helper and Context::check_* methods. Implements structured net matching with host normalization and explicit-* env prefix matching, with unit tests for workspace escape, symlinks, host normalization, port defaulting, and env ties. No dependency; can merge independently.
• Add config types in jp_config: Adds AccessConfig, FsRuleConfig, NetRuleConfig, EnvRuleConfig with MergeableVec wrappers and standard partial/delta/ToPartial impls, plus an access field on ToolConfig and an accessor on ToolConfigWithDefaults. Implements the AccessConfig to AccessPolicy conversion, canonicalizing rule paths and normalizing hosts, and adds post-merge validation rejecting access on builtin or mcp tools. Depends on Phase 1.
• Plumb access policy through jp_llm: Includes the access policy in the JSON context passed to tool commands in execute_local() and the FormatArguments path. Depends on Phase 2.
• Enforce access checks in fs_ tools*: Replaces ad-hoc path joining in the fs_* tool family with ctx.check_read(), check_create(), check_update(), check_delete(), and check_execute(), returning clear denial errors that name the capability and list configured grants. Keeps unix_utils out of scope for grant enforcement, only wiring its existing argument scanner to the shared canonicalization helper. Depends on Phase 3.
• Support wildcard-scope grants and fix --mount: Adds access to ToolsDefaultsConfig and resolves it under the replace rule in ToolConfigWithDefaults::access(), skipping builtin and MCP tools, and narrows post-merge validation to tool-declared access. Updates --mount so injected rules preserve a tool's prior reach across both scope and resource-type edges instead of silently widening or revoking access. Depends on Phase 2; independent of Phases 3 and 4.