Dev tools

Manual harness testing, raw traces, inventories, and policy inspection.

Local grants + DB-backed policies

Local grants are not JWT permissions. They are configured in harness/src/backend/inventory.mjs under AGENT_INVENTORY, narrowed by restrictedAgentForTool(), then checked by the DB policies below.

Edit via POST /api/policies. Inspect raw JSON at /api/policies.

default.allow_public_web

allow_public_web
enabled: true
config:
{"enabled":true}

default.require_approval_for_impact

require_approval_for_impact
enabled: true
config:
{"enabled":true,"impacts":["medium","high"]}

default.require_local_network_grant

require_local_network_grant
enabled: true
config:
{"enabled":true}

default.require_local_tool_grant

require_local_tool_grant
enabled: true
config:
{"enabled":true}

default.require_vc_permission

require_vc_permission
enabled: true
config:
{"enabled":true}

Direct harness tasks

Read finance documents

Read protected finance workspace documents.

JWT: space.readlocal: tool:read_finance_documentsimpact: low

Create finance document

Generate a new finance document. Low impact in this demo; no human approval required.

JWT: space.writelocal: tool:create_finance_documentimpact: low

Delete finance document

Delete a finance document. High impact; requires approval.

JWT: space.deletelocal: tool:delete_finance_documentimpact: high

Execute payment

Simulate payment execution. High impact; requires approval and permission.

JWT: payment.executelocal: tool:execute_paymentimpact: high

Read webpage

Fetch and extract text from a public webpage. Allowed by default through local harness policy.

JWT: web.readlocal: tool:web_scrapeimpact: low