Radia authorizes each operation by principal, record kind and, when configured, record contents. The same model covers workers, people, delegated calls and operational access.
Application checks depend on every worker implementing the same policy correctly. They also run after the worker has received the data.
Radia applies authorization before a query, claim or write completes. A denied record is not returned to the worker, so model behavior cannot bypass the check.
These guarantees apply at the HTTP boundary. Code embedded inside the runtime process is inside the trust boundary and must not be treated as an untrusted participant.
A grant names a principal, a record kind and allowed operations. Grants are immutable records stored in the space.
{ "principal": "agent:summarizer",
"kind": "document",
"operations": ["take", "query"] }Newer records supersede or retire earlier grants. This makes permission changes observable and preserves their history after revocation.
Capability advertisements do not confer authority. A worker may publish what it handles, but only an operator or authorized supervisor can write the grant that permits the operation.
A grant can include a pattern over declared body paths. The following grant applies only to public documents.
{ "principal": "agent:summarizer",
"kind": "document",
"operations": ["take", "query"],
"pattern": { "classification": "public" } }The runtime intersects the request pattern with every applicable grant. A query for finance documents under this grant returns only public finance documents.
Pattern scopes also apply to writes. Identity scopes provide a shorthand for records authored by the same principal, allowing multiple people to share a space without sharing application records.
An operator creates an agent definition and assigns its grants. The definition token can mint short-lived run tokens but cannot perform record operations itself.
Human sessions are ordinary principals with assigned grants. OIDC sign-in does not confer operator access; operators are configured separately.
Long-running processes renew active runs. Interactive clients may be inactive when a run expires, so they retain the definition token and exchange it for a new run token when needed.
The stored definition token cannot query, write or claim records. Its only operation is minting a run. Revoking the definition ends this exchange path.
This separates a durable minting credential from a short-lived acting credential. A leaked run token is bounded by its expiry and run ceiling; a leaked definition token can be revoked.
A direct grant check does not cover data copied into a derived record.
For example, a worker may read a local file and write part of it into a new result. The result needs to retain the source's handling restriction.
Records can carry the closed labels file, net and
foreign. Derived records inherit the union of their parents' labels. Clients may
add labels but cannot clear them.
Clearing a label requires the privileged declassify operation. Declassification creates a successor record and records who performed it.
Labels are coarse barriers, not a general information-flow type system. The set is kept small because every label expands the policy surface applications must handle.
Data lineage and authority are separate. Reading or deriving from a record does not transfer the record author's permissions to the worker.
A worker normally acts through its own grants. This prevents a participant from gaining authority by naming a privileged record as an input.
A shared worker can mint a delegated run for the author of a claimed record. The delegated run contains the intersection of the worker's grants and the caller's grants and carries no operational powers. The worker uses it for operations performed on the caller's behalf.
The runtime resolves the caller through the run that created the claimed record. The worker cannot choose or assert that identity in a request body.
The permissions endpoint computes access through the same projection used for enforcement. It reports active operations and their scopes after revocations and superseding grants.
$ radia permissions agent:summarizer
KIND OPERATIONS SCOPE
document take, query classification=public
summary put own records only
Principals may inspect their own permissions. Inspecting another principal requires the
observe power or operator status.
Operational verbs use separate powers: global observation, remediation, garbage collection, declassification and payload destruction.
Operators assign these powers through revocable ops_grant records.
observe reads globally, remediate changes stuck envelope state,
sweep runs garbage collection, declassify clears labels and purge
destroys payloads. Writing authorization records and bypassing record grants remain restricted
to named operators.
The provisioned MCP observer receives observe only. Its credential is revocable
through the same agent-definition mechanism.
radia login --sso), and deprovisioning at the identity provider ends
access within one session ceiling. Operators stay a local config set: an IdP can never
mint one.