Skip to content

feat: Access Control & Namespace Isolation (deferred) #25

@DarlingtonDeveloper

Description

@DarlingtonDeveloper

Summary

Namespace isolation so agents cannot overwrite each other's prompts. Deferred — documenting requirements for later implementation.

Requirements (from discussion)

  • Each agent should only be able to write to its own prompt namespace
  • Read access can be broader (agents can read shared skills)
  • Prevent accidental overwrites (Lily editing kai-soul)
  • Admin/operator has full access across all namespaces

Possible Design

  • Namespace = tag prefix on prompt nodes (e.g. ns:kai, ns:shared)
  • Write operations check the requesting agent's namespace scope
  • Read operations: agents can read ns:shared + their own namespace
  • Admin operations bypass namespace checks

Open Questions

  • How does this interact with the API? Token-based auth per agent?
  • Should namespaces be hierarchical? (e.g. ns:swarm:kai)
  • What about shared skills that multiple agents contribute to?

Status

Deferred — not needed for initial implementation. Current agent count is small and trust is high. Implement when multi-tenancy or external users become relevant.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions