PermissionsMode

type PermissionsMode = "off" | "infer" | "check";

Defined in: packages/core/src/config.ts:15

Least-privilege permissions policy.

• off: no-op (default). The pass never rewrites or audits output.
• infer: emit each job's computed minimal permissions: union and a top-level permissions: {} deny-all baseline when the root declares none.
• check: audit each job's declared block against the computed minimum and warn on over-grant (escalated to a build error under actio check).