Reference
Authorization model
JoyMux authorizes each session action against the calling client and any grants on that session. Unknown clients are denied. Session owners have owner permissions. Other clients need an active grant that includes the required permission.
Session actions → permissions
| Action | Permission |
|---|---|
| discover / list visibility | discover |
| get / metadata | read_metadata |
| events / replay | read_events |
| attach | attach_read_only |
| write | write_input |
| resize | resize |
| interrupt | interrupt |
| terminate | terminate |
| close | close |
| grant / revoke | manage_grants |
Inspection
session/permissions— effective view for the callersession/can— dry-run one action
Observable contract
Authorization is evaluated against persisted grants at the time of the operation. After a revoke commits, later operations using that grant are denied. There is no partial authorization of a single operation.
Transport is not authority: CLI, SDK, MCP, and HTTP use the same permission model.
See security and error model.