CapabilitySource tracks where a capability came from. This is useful for debugging, auditing, and understanding how permissions were granted.
Factory Methods
user
allow_path() or allow_file().
group
str
required
Name of the policy group (e.g.,
"claude-code", "development").system
String Representation
Usage
The source is attached to eachFsCapability and can be accessed via the source property:
Source Priority
When deduplicating capabilities withCapabilitySet.deduplicate(), user-granted capabilities take priority over system-granted ones. This ensures user intent is preserved.
Related
- FsCapability.source - Access source on a capability
- CapabilitySet.deduplicate() - Handles source priority