Security and approvals

Enverif is designed so the language model proposes work but the runtime decides what is allowed.

Permission order

1. Explicit deny pattern.
2. Explicit allow pattern, except protected destructive/secret categories.
3. Risk default.

Read/internal-write/network operations are allowed by default. External writes ask unless autonomous external writes are enabled. Secret access always asks. Destructive operations are denied unless destructive capability is enabled, and then still ask.

Approval resume

When approval is required, the exact persisted tool step changes to awaiting_approval. The run stops advancing. A human decision is stored against that step. Approval resumes the same persisted tool call; denial returns a tool error to the model so the agent can adapt without executing the action.

Audit chain

Security-relevant events are appended with a hash of the prior event, producing a tamper-evident sequence within the application database. Export audit history regularly to immutable external storage if your compliance program requires stronger guarantees.