Scoped Permission Grant

An agent asks for one right; allow it once, for an hour, or always for this target.

PROGet Scoped Permission Grant and 168 other Pro components with pro lifetime — Get Pro

Category
AI Agent
Access
Pro
Source
987 lines · one file
States
9 drawn
Added
21 Oct 2026

The decision inside it

Always means always for this target

"Always allow email.send" is a blank cheque. Here Always covers one target (email.send to @vertically.com) and every other recipient still asks. Allowing any target is a separate choice behind the overflow, marked Wider, and high-risk grants ask for a press and hold.

When to use it

Use Permission Grant when an agent asks for one right on one target: allow once, for an hour or always for this target, or deny with a reason. Pass grants instead to list every active grant with Revoke. For a one-off yes or no on an action use Approval Request.

Installation

How you get it

Paste this into Claude Code, Cursor, Codex or any coding agent. It installs the file and uses it as it is, instead of writing a new one.

Use Liro's Scoped Permission Grant for this.
Install it: npx shadcn@latest add @liro/permission-grant
(the @liro registry is set up in components.json, with LIRO_KEY in .env.local)
Import it from @/components/ui/permission-grant.
Do not rewrite or restyle it. Pass my data through its props
and keep its built-in states.

For the full brief with every prop and the mistakes assistants usually make, use Copy prompt above. Pro components install through the @liro registry with your CLI token: see the Namespaced tab.

Usage

components/grant-email.tsx
import { PermissionGrant, type GrantScope } from "@/components/ui/permission-grant";

export function GrantEmail({ api }: {
  api: { grant: (scope: GrantScope) => Promise<void>; deny: (reason?: string) => Promise<void>; revoke: () => Promise<void> };
}) {
  return (
    <PermissionGrant
      agent="Renewal agent"
      tool="email.send"
      target="@vertically.com"
      anyTarget="any recipient"
      why="Olivia asked for the signed renewal by email."
      risk="medium"
      onGrant={api.grant}
      onDeny={api.deny}
      onRevoke={api.revoke}
      reasons={["Wrong recipient", "Not yet"]}
    />
  );
}

API reference

“Copy prompt” above puts a full brief on your clipboard, install command, dependencies, props, and the mistakes an assistant usually makes with this component.

Props

Read from the component’s own TypeScript interface when the site is built, so this table cannot drift from the file you install.

TypeNotes
grantsundefined No–
agentstring YesWho is asking: "Renewal agent".
avatarReact.ReactNode NoThe agent's mark or avatar. Without one, a plain agent glyph stands in.
toolstring YesThe right it wants: `email.send`.
toolIconReact.ReactNode NoOptional mark of the app behind the tool (a Gmail logo for `email.send`), shown before its name.
targetstring YesThe exact target, shown in mono: "@vertically.com", "/contracts/vertically".
anyTargetstring NoHow "any target" reads for this tool: "any recipient". Default "any target".
whyReact.ReactNode NoWhy, in one sentence from the agent.
previewReact.ReactNode NoExactly what will happen: a recipient list, a path, an amount.
riskGrantRisk NoDefault `medium`. High asks for a hold before an "Always".
allowAnyTargetboolean NoOffer "Always for any target" in the overflow. Default true.
onGrant(scope: GrantScope) => void | Grant | Promise<void | Grant> NoMay return a promise, and may resolve with the server's own `expiresAt`.
onDeny(reason?: string) => void | Promise<void> NoThe reason goes back to the agent. May return a promise.
onRevoke() => void | Promise<void> NoMay return a promise; the line waits for it and shows any error.
onRestore(grant: Grant) => void | Promise<void> NoUndo after a revoke. Default: calls `onGrant` with the same scope.
grantGrant | null NoControlled grant. `null` means none yet; leave it out to let the card keep its own.
defaultGrantGrant | null No–
onGrantChange(grant: Grant | null) => void No–
reasonsstring[] NoOne-click reasons offered on Deny.

Dependencies

npm packages

clsxframer-motionlucide-reacttailwind-merge

Liro foundations, installed alongside it

liro-themebadgebutton

States

All of them are drawn by the component. None is left for you to design.

  • Asking
  • Allowed once
  • For 1 hour
  • Always for target
  • Denied
  • Expired
  • Revoked
  • Grant failed
  • List

Accessibility

  • Keyboard reachable throughout, in visual order
  • Focus trapped in overlays, Escape closes them
  • Focus returns to whatever opened it
  • Live regions announce what changed, not that something did
  • Honours prefers-reduced-motion

Responsive behavior

  • Sizes to its container, not the viewport
  • Usable from 320px up
  • Pointer-based interaction, so trackpad and touch both work
  • No hover-only affordances