Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.oktolabs.ai/llms.txt

Use this file to discover all available pages before exploring further.

​
Permission model

You can use the permission model to restrict what each agent can do on each board. Pulse enforces permissions before MCP tools execute, so role boundaries are not only advisory.

​
The flag namespace

Current source defines 270 enabled granular flags. They use dotted paths: 
spec.move.draft_to_review
card.validation.submit
kg.query.decision_history
Top-level namespaces are board, profile, guidelines, ideation, refinement, spec, sprint, card, comments, attachments, and kg.

​
The ceiling model

resolve_permissions starts with an agent’s base permission set and then applies board overrides. A board override can restrict a flag, but it cannot grant capability beyond the agent’s base role.

​
State-aware checks

Entity work is gated by both operation flags and interact_in flags. For example, an agent might be allowed to read cards but only interact with cards in in_progress, not cards in validation.

​
Absent flags default to allowed

For backward compatibility, unknown or absent flags resolve as allowed. That keeps older agents working while the registry evolves. New security-sensitive work should set explicit flags instead of relying on this compatibility path.

​
Legacy flat permissions

The older flat model had 19 constants such as board:read, cards:create, and specs:evaluate. map_legacy_permissions maps those old constants into granular flags. New agents should use granular presets or custom flags.

​
Namespace counts

NamespaceEnabled flags
board5
profile1
guidelines6
ideation36
refinement40
spec62
sprint25
card72
kg23
Last modified on May 8, 2026