Skip to main content
KARMAX runs code it did not write: recipes you wrote, workflows from a registry, connectors you enabled. The Broker decides what each of them may do. Default deny. A subject holding no grants is refused everything. There is no implicit permission derived from having been installed.

​
Grants

A grant is subject → capability:value. Patterns are deliberately limited to *, prefix.* and *.suffix. A grant language nobody can read at a glance is a grant language that gets approved without being read.

​
Where grants come from

A workflow’s manifest. Installing it grants exactly what the manifest declared — and an upgrade replaces the set rather than merging, so a version that no longer asks for something actually loses it. You see the list before anything is written:

​
Trust tiers

All three are gated identically by the Broker. The tier says who vouched for the code, not what it may do.
verify also reports a loop built against a different host ABI. A signature proves an artifact is intact, not that it still fits — a loop declaring host functions this KARMAX no longer has would install, run, and be refused on its first real call, which looks exactly like a loop that decided to do nothing.

​
Two gates, not one

Every tool call passes both:
1

The signed manifest

Is this tool in the tools: list the operator approved? tool is a single host function, so a workflow that declares it could otherwise name anything in the registry.
2

The Broker

Has the operator granted tool:<name> to this subject?
Either one refusing refuses the call. A grant of tool:* does not let a workflow call something its manifest never listed.