# ScopeLevel (/docs/api/type-aliases/ScopeLevel)



```ts
type ScopeLevel = "read" | "write";
```

Defined in: [packages/core/src/passes/permissions.ts:20](https://github.com/austenstone/actio/blob/2b01e694a0f76521d8c073f3c6a2e48917d2c9d9/packages/core/src/passes/permissions.ts#L20)

permissions least-privilege pass: compute the minimal `permissions:` block each
job needs from its steps and either emit it (`infer`) or audit the declared
block against it (`check`). Default `off` so it never silently rewrites output.

LATE pass: runs after every step-producing macro expands so it sees the final
step list. Pure IR (no `node:*`) so it composes into the browser bundle.

SAFETY INVARIANT: never silently under-grant. An action we cannot map (and no
user override) makes the job "unknown": we emit a diagnostic and, in `infer`
mode, only ever broaden (never narrow) such a job.


## Sitemap

Browse the full documentation: [Markdown sitemap](https://austenstone.github.io/actio/sitemap.md) · [XML sitemap](https://austenstone.github.io/actio/sitemap.xml)