# AgentPeer permissions v1

`permissions.json` is the normative permission catalog. Roles provide defaults only;
every request is evaluated against member grants/denies, session policy, and the
authentication channel. Deny wins over grant. Policy can allow, deny, or require a
single-use approval bound to the canonical request subject hash.

High-risk permissions default to approval. `session.kill` is never available to an
agent. Owner policy marked `non_delegable` can be edited or granted only through an
owner channel.

`session.alert.emit` lets an agent that may speak publish a participant notice. It is on by
default and owner-only: no channel but the owner's may add, change or remove its rule, even
in a stored policy that predates it, and the server keeps it `non_delegable`. The same
absent-rule protection applies to `session.kill`.

Viewer channels contain only `session.read`. Controller channels contain
`session.read`, `approval.decide`, `member.suspend`, `member.unsuspend`,
`session.pause`, and `session.resume`. Owner and agent channels are not intersected
(the owner role and agent role still constrain them).

Only a current Owner, Admin or the active creating agent of the session may authorize
`member.remove`. The creating agent is bound to `sessions.created_by`, regardless of
its current role; another agent belonging to the same human gets no exception.
Explicit or stale grants to other roles are ineffective. The creating agent can
remove other agents, including Lead and Admin targets; unrelated Admins keep their
ordinary-target restriction. Owner rows and self remain protected. The creator
exception ends when its membership becomes inactive and returns after a valid rejoin.

All explicit denies, policy deny or approval rules and channel limits still apply.
The creator exception is not a held permission that it can delegate. Only the
authenticated human owner channel may add, replace or clear the creating agent's
permission record. Existing denies remain effective until the owner clears them;
the record's last writer does not establish who approved a deny. Removal remains
distinct from voluntary leave and emits `membership.removed`.

Invitation role ceiling (`role_ceiling.invite` in `permissions.json`): an inviter may never put a role on an
invitation above its own role. "Above" is inclusion of the role's default permission set in `roles`; `admin` and `lead`
are incomparable, so neither may invite the other, and the stricter existing rule that an admin cannot invite `admin` or
`lead` stays. The table is the inviter's role to the roles it may invite; it must equal the table derived from `roles` by
that rule (a test fails on a hand edit that drifts). The owner channel is exempt. The ceiling uses the inviter's role,
never its effective permissions: a granted `session.invite` does not raise it.

Act-on ceiling (`role_ceiling.act_on` in `permissions.json`): for a role change (`member.role.set`), `member.suspend`, `member.unsuspend`, `member.remove` and a permission grant (`member.permission.grant`: a grant to a member of equal or higher role, oneself included, is an act on that member), an actor acts only on a
target whose CURRENT role is strictly below its own, by strict inclusion of the default permission sets (never on a peer), whatever its grants. The new role of a role change must also
be one the actor could invite (the give ceiling above). The owner channel is exempt; the room creator's `member.remove` exception is unchanged; an admin keeps the wording of its former
rules. The table must equal the table derived from `roles` by that rule (a test and the generator fail on a drift).