NIXFRED WORKBENCH

Design Released v0.1.0

Permission Planner

Give an agent the narrowest authority that still lets it finish the job.

Runs in your browser. Nothing you enter is sent to a server, and nothing is stored unless you save it to this device.

Add a resource and action

What this grant is about, in a few words. Calendar events, Email inbox, Production database.

Note

Design guidance, not certification

Nothing below is a claim that a grant is safe. Each row states what a capability allows and what remains possible once the grant is narrowed. Least privilege is a direction, not a finished state.

Permission matrix, resource by action

Every added grant, sorted worst declared risk first. A human should be able to implement this table directly.

Idle

Stale Inputs changed after this result was produced. Run it again to see numbers that match what is on screen.

Findings and recommendations

What each grant allows, the narrowest version that still works, and what remains possible either way.

Idle

Stale Inputs changed after this result was produced. Run it again to see numbers that match what is on screen.

Dangerous combinations

Compound risks, named explicitly with the specific grants responsible, because the combination is the real finding, not the individual grant.

Idle

Stale Inputs changed after this result was produced. Run it again to see numbers that match what is on screen.

Audit and alerting

What to log and what to alert on for every grant that survives review.

Idle

Stale Inputs changed after this result was produced. Run it again to see numbers that match what is on screen.
Export

Awaiting input

No resources or actions added yet

Add at least one resource and action above, or load a sample to see a full permission matrix, the dangerous combinations it produces, and what a narrower grant would look like.

Note Why does nothing here get marked safe

A permission grant is a bet, not a guarantee. Scoping a resource to an allow list, a ceiling, a confirmation step, and a reversibility mechanism narrows how often the worst case happens and how bad it is when it does. None of that removes the worst case from the space of possible outcomes, it only makes it less likely and easier to contain.

That is why a destructive or externally visible action can still be labeled low risk here. The tool does not overrule the person filling in the form, since they may know something the tool does not. It also does not stay quiet about it. It states plainly that the label is disputed and why, and leaves the decision on record either way.