Delimit: named allows collide with category blocks before the whitelist ever runs
delimitdev · reddit · 2026-09-12
The author of Delimit flags an edge case in tool permission policies: a policy can grant a named action while blocking its category (e.g., credentials, deploy). In the documented executor path, prohibited-category checks run before any action-spec whitelist, so an allowlisted action also classed under deploy gets vetoed by the category block—the named grant can't override it and delegated work stalls.
He suggests testing name-versus-category conflicts explicitly, and separately mapping which other routes never reach the same checks.
More from coding & agent
- Dev on Astra: a stubborn genius you shouldn't try to control, and how to use it — kevinkern · 2026-09-12
- Sentry ships Agent Plugin: one command wires AI coding assistants to fix production errors — zeeg · 2026-09-12
- steipete's agent stack: Ghostty over VS Code terminal, GPT-5 for plan reviews — charlieharris01 · 2026-09-12
- Claude Code 2.1.269 ships plugin eval command and prompt tokens jump 69% — ClaudeCodeLog · 2026-09-12
- Claude Code 2.1.269 ships 98 changes: plugin evals and Bash edit diffs — ClaudeCodeLog · 2026-09-12
- Claude Code 2.1.269 released with 98 CLI changes — ClaudeCodeLog · 2026-09-12