httppayai

agents.writerslogic.com

Computes what a sub-agent may actually do: the permissions it requested, intersected with what the end user holds and what its parent agent holds, minus any explicit deny list, and says for each denied permission which party lacks it. Permission names are compared exactly (no wildcards); caller-declared implications (for example 'admin' grants 'read') can be given and are expanded transitively with cycles tolerated. fail when any requested permission is not granted (privilege escalation attempt: requested beyond the parent is marked); pass when all are. Does not authenticate anyone or know any permission model.