> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oktolabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Permission model

> How Pulse resolves granular flags, board overrides, state checks, and legacy permissions.

# Permission model

You can use the permission model to restrict what each agent can do on each board. Pulse enforces permissions before MCP tools execute, so role boundaries are not only advisory.

## The flag namespace

Current source defines `270` enabled granular flags. They use dotted paths:

```text theme={null}
spec.move.draft_to_review
card.validation.submit
kg.query.decision_history
```

Top-level namespaces are `board`, `profile`, `guidelines`, `ideation`, `refinement`, `spec`, `sprint`, `card`, `comments`, `attachments`, and `kg`.

## The ceiling model

`resolve_permissions` starts with an agent's base permission set and then applies board overrides. A board override can restrict a flag, but it cannot grant capability beyond the agent's base role.

## State-aware checks

Entity work is gated by both operation flags and `interact_in` flags. For example, an agent might be allowed to read cards but only interact with cards in `in_progress`, not cards in `validation`.

## Absent flags default to allowed

For backward compatibility, unknown or absent flags resolve as allowed. That keeps older agents working while the registry evolves. New security-sensitive work should set explicit flags instead of relying on this compatibility path.

## Legacy flat permissions

The older flat model had 19 constants such as `board:read`, `cards:create`, and `specs:evaluate`. `map_legacy_permissions` maps those old constants into granular flags. New agents should use granular presets or custom flags.

## Namespace counts

| Namespace    | Enabled flags |
| ------------ | ------------- |
| `board`      | 5             |
| `profile`    | 1             |
| `guidelines` | 6             |
| `ideation`   | 36            |
| `refinement` | 40            |
| `spec`       | 62            |
| `sprint`     | 25            |
| `card`       | 72            |
| `kg`         | 23            |

## Related pages

* [Built-in presets](/permissions/presets)
* [Custom permissions](/permissions/custom)
* [Board and profile flags](/permissions/board)