/**
 * Workspace-scoped permission model for swarm subagents (dream-cycle #2768,
 * ClawArena finding: privilege granting is the #1 orchestration bottleneck,
 * no LLM > 50% workspace-permission precision as team lead).
 *
 * SCOPE (honest): this is a METADATA + AUDIT layer, not a runtime sandbox.
 * Claude Code's Task tool owns the actual subprocess sandbox; ruflo cannot
 * enforce at the syscall boundary. What we CAN do:
 *   1. Publish a per-role capability manifest that Task-tool prompts can
 *      consult ("your workspace-scoped tools are X, Y, Z; you may not use W").
 *   2. Record every grant/check/deny/revoke to an append-only audit trail
 *      so the swarm has a reviewable permission history.
 *
 * That is enough to close the "permission-hygiene" half of the ClawArena
 * finding — the "50% precision as team lead" number is about the LLM's
 * decision QUALITY, which no runtime layer fixes.
 */
import type { PathValidator } from '@claude-flow/security';
/** A single agent role's capability envelope. */
export interface PermissionSet {
    /** Symbolic role name — matches ruflo agent-type names (coder, tester, reviewer, …). */
    role: string;
    /** Tools this role MAY use. Empty array = deny-all-tools. */
    allowedTools: string[];
    /** Tools this role MUST NOT use (evaluated after allow — deny wins). */
    deniedTools: string[];
    /** Glob patterns this role MAY read/write, relative to swarm cwd. */
    allowedPaths: string[];
    /** Glob patterns this role MUST NOT touch (deny wins). */
    deniedPaths: string[];
    /** Exact-host allowlist for outbound network. Empty = deny-all-network. */
    allowedNetworkHosts: string[];
    /** Human-readable note explaining the intent of this envelope. */
    notes?: string;
}
/** Built-in presets, ordered narrow → wide. Each preset ships per-role sets. */
export declare const PRESETS: Record<'strict' | 'standard' | 'permissive', PermissionSet[]>;
export type PresetName = keyof typeof PRESETS;
/**
 * Resolve a preset name to its per-role sets. Throws on unknown preset —
 * fail loud so a typo doesn't silently degrade to permissive.
 */
export declare function resolvePreset(name: string): PermissionSet[];
/**
 * Sanity-check a permission set: role name shape, no null entries.
 * Path validation is deferred to the enforcement side (PathValidator)
 * so this module has no @claude-flow/security runtime dep beyond a
 * type-only import.
 */
export declare function validatePermissionSet(set: PermissionSet, _validator?: PathValidator): string[];
//# sourceMappingURL=permission-set.d.ts.map