Manual / Owner administration
Authority

Owner administration

Owner administration is deliberately separate from the governed runtime surface.

Administrator boundary

On the qualified Linux path, the administrator endpoint is an owner-only Unix-domain socket under the owner runtime directory. The controller validates directory ownership/permissions and Linux peer credentials. Governed agent sandboxes do not receive that socket.

The v0.1 boundary does not claim protection against arbitrary already-compromised unsandboxed software running as the same owner UID.

Common commands

lacctl skills list
lacctl permissions list
lacctl pending list
lacctl approvals list
lacctl emergency status

lac-owner decide <allow-once|always-allow|ask-every-time|deny-once|always-deny>   <continuation_id> <pending_id>

Low-level policy administration

lacctl permissions set --file <policy.json>
lacctl permissions revoke <rule|default> <id>

permissions set --file is a low-level administrator/scripting primitive, not the ordinary first-use workflow.

Emergency pause

lacctl emergency pause
lacctl emergency status
lacctl emergency resume
Emergency resume is not retroactive authorization. It does not revive a request that already completed as denied/blocked, and it does not bypass current policy or approval checks.

Exact approvals

lacctl approvals show <decision_id>
lacctl approvals approve <decision_id>
lacctl approvals reject <decision_id>

Approvals are exact, immutable decisions tied to canonical request material and expiry. They do not dispatch by themselves.