Skip to main content
CapabilitySource tracks where a capability came from. This is useful for debugging, auditing, and understanding how permissions were granted.

Factory Methods

user

Create a user-sourced capability. This is the default source when you call allow_path() or allow_file().

group

Create a group-sourced capability. Used when permissions come from a named policy group.
str
required
Name of the policy group (e.g., "claude-code", "development").

system

Create a system-sourced capability. Used for paths required for basic system operation.

String Representation

Usage

The source is attached to each FsCapability and can be accessed via the source property:

Source Priority

When deduplicating capabilities with CapabilitySet.deduplicate(), user-granted capabilities take priority over system-granted ones. This ensures user intent is preserved.