Architecture
Permission model — 3 risk levels × 4 review modes
LVIS's permission decisions run along two axes: a tool's risk level (low/medium/high) and the automatic review mode (disabled / rule / LLM-assisted / strict). Users can directly control how much automation they want.
3 risk levels
4 review modes
5 tool categories
parent-decided sub-agent asks
Risk level — low, medium, high
Every tool has a predetermined "how risky is this tool" rating. This risk level cannot be changed arbitrarily by the tool's author — only a value that has passed the host's review is valid.
Review modes — controlling automation intensity
Disabled
Automatic review is not used. Every tool branches purely by category.
Rule
Judged quickly using only static rules. No LLM call.
LLM-assisted
For medium/high-risk calls, an LLM also reviews the arguments and context to add a recommendation.
Strict
Shows a dialog for both medium and high risk. Minimizes automation.
Tool categories
- Read — only fetches information. The safest category.
- Write — makes changes to an external system or file.
- Execute — runs external commands or external code. The most conservatively handled category.
- Network — communicates externally.
- Internal — LVIS's own meta operations (e.g. changing settings).
When a sub-agent asks — the parent answers first
An agent can spawn sub-agents. When a sub-agent asks to use a tool, the question does not go straight to the user: the parent agent that spawned it answers first. Only what the parent cannot answer is escalated to the user. This ships on by default.
- There is a ceiling on what a parent may decide. It defaults to medium, and the only two values the field accepts are low and medium — so high risk cannot pass through this lane and goes to the user. The ceiling is applied before the parent is asked, not by trimming its answer afterwards.
- The evidence the parent sees is host-composed. There is no field in it for a sentence a sub-agent wrote to argue its own case. The one exception is the tool arguments being judged — they are the call, so they cannot be withheld; they are passed masked and labelled as the sub-agent's own words rather than as neutral fact.
- There are limits on time and count. One adjudication has a time bound, and one sub-agent run has a budget of adjudications. Past either, the ask escalates to the user.
- Conversation content does not leave by default. There is a setting that quotes the parent conversation's recent turns into the evidence, but its default is zero turns. Raising it sends the user's own words to the reviewing model, so it only works if it is deliberately turned on.
- These values are visible under Settings → Permissions. The risk ceiling is the one that moves in the narrowing direction only — the time bound, the count budget, and the number of quoted turns can each be raised above their defaults, and each is clamped to a maximum fixed in code.
This lane sits after the host's hard checks
The question only reaches the parent once the host's hard checks have already cleared the call. A parent answer cannot re-open something already refused, and it applies to that one call only — it is not remembered as "allow from now on". The outcome is written to the audit log with an
answeredBy field naming who answered it.No bypass
Revoking a permission stops it immediately
Once a granted permission is revoked, the tool that needed it stops immediately on its next call, with no fallback. No bypass path is left open that could let an action the user thought they'd already approved happen again quietly.