Permission scope map
Bird's-eye view of which scopes an agent (or whole workspace) holds. Tier chip signals whether the rule was set at workspace, project, or run level.
Included in the single kansho full pack. Components are not offered as separate installs.
Workspace map for Plan & dispatch
Audit ledger tables. Read is auto-granted; writes require approval per run.
Auto: readAsk: writeDenied: deleteGranted: index- writealways asks until policy promoted
Mission dispatch queue. Orchestrator-only.
Granted: readGranted: writeAsk: deleteSandbox secrets. Read scoped to active mission session.
Auto: readGranted: rotateDenied: delete- readsession-scoped
Slack write capability for the current run only.
Granted: post-messageAsk: open-imDenied: channels.writeEmbedding provider. Capped at $200/mo.
Inherited: exec- execblocked when over cap
Included components
This page is the canonical destination for these components. All ship in the single Kansho pack.
Permission legend
components/control-plane/permission-legend.tsxComponent documentation
Permission legend
components/control-plane/permission-legend.tsxPurpose
Adapts caller-supplied permission metadata into the shared Legend primitive.
Appropriate use
Use beside a permission matrix when its modes need consistent icon, label, and tone explanations.
Example
components/control-plane/permission-legend.tsx has a representative live example in the "Workspace map for Plan & dispatch" section on /components/permission-scope-map.
States
The component has no fixed modes; each item supplies its id, label, icon, background class, and foreground class.
API and props
PermissionLegend accepts items and optional className; PermissionLegendItem supplies id, label, Icon, bg, and fg.
Dependencies
Direct imports are React, Legend, and cn.
Accessibility
Each legend entry includes visible text; icons are hidden from assistive technology so meaning does not depend on icon or colour.
Limitations
It trusts caller-supplied presentation classes and does not validate contrast, deduplicate items, or enforce permission semantics.
Source
Source: components/control-plane/permission-legend.tsx.
Full pack
components/control-plane/permission-legend.tsx is documented at /components/permission-scope-map and installs only through the single Kansho full pack; no individual component install is offered.
Permission Scope Map
components/control-plane/permission-scope-map.tsxPurpose
Shows effective permission verbs grouped by scope and inheritance tier.
Appropriate use
Use for auditing a workspace, project, or run permission map in read-only form.
Example
components/control-plane/permission-scope-map.tsx has a representative live example in the "Workspace map for Plan & dispatch" section on /components/permission-scope-map.
States
Modes are granted, denied, ask, auto, and inherited; groups use workspace, project, or run tiers and may be collapsed.
API and props
PermissionScopeMap accepts groups, className, and caption; each ScopeGroup supplies id, scope, optional tier, optional description, and permissions, while each permission supplies action, mode, and optional note.
Dependencies
Direct imports are React, Lucide icons, Disclosure, PermissionLegend, shared permission tones, and cn.
Accessibility
A caption identifies the map, groups use keyboard disclosures, and every mode and action is explicit text with icons hidden.
Limitations
It does not calculate effective permissions, edit policy, resolve inheritance, or validate action and scope strings.
Source
Source: components/control-plane/permission-scope-map.tsx.
Full pack
components/control-plane/permission-scope-map.tsx is documented at /components/permission-scope-map and installs only through the single Kansho full pack; no individual component install is offered.