Declaring Plugin Permissions

Drive a Lerian plugin team through authoring permissions.yaml — the client-side, SEMANTIC declaration the plugin PUBLISHES at boot under the access-manager inversion. This is an interactive workflow: follow the steps in order and use AskUserQuestion to gather every choice. Do not free-hand a manifest.

Overview

Schema authority: lib-auth/v3 auth/declaration/manifest.go (>= v3.4.0-beta.1), mirrored server-side by plugin-access-manager identity/pkg/model/declaration.go. The reconciler validates this exact shape at boot and refuses a bad manifest.

THE CRITICAL INVARIANT: every (resource, action) pair in the manifest MUST exactly match a real AuthClient.Authorize(service, resource, action) guard in the plugin (lib-auth auth/middleware/middleware.go). If they diverge, authz silently breaks — the guard demands a permission the manifest never declared. Adopting the semantic standard therefore means the route guards AND the manifest move together.