# PermissionsMode (/docs/api/type-aliases/PermissionsMode)



```ts
type PermissionsMode = "off" | "infer" | "check";
```

Defined in: [packages/core/src/config.ts:15](https://github.com/austenstone/actio/blob/2b01e694a0f76521d8c073f3c6a2e48917d2c9d9/packages/core/src/config.ts#L15)

Least-privilege permissions policy.

* `off`: no-op (default). The pass never rewrites or audits output.
* `infer`: emit each job's computed minimal `permissions:` union and a
  top-level `permissions: {}` deny-all baseline when the root declares none.
* `check`: audit each job's declared block against the computed minimum and
  warn on over-grant (escalated to a build error under `actio check`).


## Sitemap

Browse the full documentation: [Markdown sitemap](https://austenstone.github.io/actio/sitemap.md) · [XML sitemap](https://austenstone.github.io/actio/sitemap.xml)