Review permission decisions
cmdop permissions audit shows what the permission rules recently allowed,
asked about, or denied on that machine — the 50 most recent decisions, widened
with --tail or followed live with --follow. Read it next to
cmdop permissions list to tell whether a rule matched or the mode decided. It
is local operational evidence, not a retained compliance archive.
Every decision the permission rules make on a machine — allowed, asked, or denied — is recorded there. Show the latest ones on the affected machine:
cmdop permissions auditaudit shows the 50 most recent decisions. Widen the window, or follow new
decisions live while you reproduce a safe request:
cmdop permissions audit --tail 200
cmdop permissions audit --followReview the result alongside the effective policy:
cmdop permissions listUse the decision, target, matched rule, and timing to answer three questions:
- Did the request reach the permission rules at all? A request on a path the rules do not cover leaves no entry — see what the gate covers.
- Did a rule match, or did the current mode decide the outcome?
- Should the task change, or is one narrower rule justified?
The audit is local operational evidence. Cmdop does not publish it as a centralized compliance archive or guarantee a retention period. Export it into your approved logging system when your organization needs durable retention.
Common questions
How do I see why Cmdop allowed or denied a tool call?
Run cmdop permissions audit on the affected machine and compare it with
cmdop permissions list. The audit shows recent decisions; the list shows the
effective rules and mode.
Does the permission audit prove every access decision?
No. It records decisions made by the permission policy on that machine. If a request used a path the rules do not cover, there may be no audit entry.
Is the permission audit a compliance archive?
No. Treat it as local operational evidence. If your organization needs durable retention, export the relevant data into your approved logging or audit system.
Cmdop