Permissions

Permissions

Vorim has seven permission scopes. They are independent of one another, not a ladder.

Holding agent:write does not imply agent:read. Every scope an agent needs is granted explicitly, which is why each demo agent lists the full set it uses. Read the seven as a checklist rather than a hierarchy.

vorim.check(agentId, scope)

Check if an agent has a specific permission. Use this before every action.

Check before the action, not after it. A check that runs once the side effect has already happened records what occurred but cannot prevent it, and preventing it is the whole point of holding a scope.

Decisions are cached in Redis, and an allow read from that cache is re-confirmed against the database before it is honored. A grant that has since been revoked, expired, or belongs to a deactivated agent is therefore denied on the very next check rather than lingering until the cache lapses.

const result = await vorim.check('agid_acme_a1b2c3d4', 'agent:write');

if (result.allowed) {
  // Agent is authorized — proceed with the action
  await performWrite();
} else {
  console.log('Permission denied:', result.reason);
}

// Response shape
{
  allowed: true,
  agent_id: 'agid_acme_a1b2c3d4',
  scope: 'agent:write',
  reason: undefined, // populated with the denial reason when allowed is false
}

vorim.grant(agentId, scope, options?)

Grant a permission scope to an agent with optional constraints.

// Grant with expiration
await vorim.grant('agid_acme_a1b2c3d4', 'agent:transact', {
  valid_until: '2026-06-01T00:00:00Z',
});

// Grant with rate limiting
await vorim.grant('agid_acme_a1b2c3d4', 'agent:communicate', {
  rate_limit: { max: 100, window: '1h' },
});

Book a demo for a walkthrough, or contact us for support. For enterprise needs, reach out at sales@vorim.ai.