@gotgenes/pi-permission-system 27.0.0 → 27.1.0

package/src/handlers/gates/bash-external-directory.ts

@@ -17,6 +17,13 @@ import type { ToolCallContext } from "./types";
  * Returns a `GateBypass` when all paths are allowed (by config or session rule).
  * Returns a `GateDescriptor` with multi-pattern sessionApproval for uncovered paths.
  *
+ * Each path is resolved on the narrowest `external_directory`-family surface
+ * its own attributed effect names. The session approval holds one surface for
+ * all its patterns, so it narrows only when every uncovered path agrees; a
+ * mixed-direction ask falls back to the bare family, which is exactly today's
+ * width. Closing that last gap needs `(surface, pattern)` pairs on the
+ * approval and its forwarded wire form (#810).
+ *
  * The shell command (native `bash` or an aliased shell tool) is read from the
  * injected `BashProgram`, which owns the source text it was parsed from, so
  * this gate does not re-derive the input field name (#574).
@@ -30,8 +37,8 @@ export function describeBashExternalDirectoryGate(
   if (!bashProgram) return null;
   const command = bashProgram.commandText();
 
-  const externalPaths = bashProgram.externalPaths();
-  if (externalPaths.length === 0) return null;
+  const externalAccesses = bashProgram.externalAccesses();
+  if (externalAccesses.length === 0) return null;
 
   // Resolve every external path on the external_directory surface and keep the
   // ones not already allowed (config-level allows suppress the prompt just as
@@ -39,7 +46,7 @@ export function describeBashExternalDirectoryGate(
   // matching and the worst-uncovered selection.
   const { uncovered: uncoveredEntries, worstCheck } =
     selectUncoveredExternalPaths(
-      externalPaths,
+      externalAccesses,
       resolver,
       tcc.agentName ?? undefined,
     );
@@ -65,7 +72,7 @@ export function describeBashExternalDirectoryGate(
           toolName: tcc.toolName,
           agentName: tcc.agentName,
           command,
-          externalPaths: externalPaths.map((p) => p.value()),
+          externalPaths: externalAccesses.map(({ path }) => path.value()),
           resolution: "session_approved",
         },
       },
@@ -86,6 +93,7 @@ export function describeBashExternalDirectoryGate(
     resolvedPath: path.resolvedAlias(),
   }));
 
+  const surface = worstEntry.surface;
   const payload = buildBashExternalDirectoryAskPayload({
     command,
     externalPaths: disclosures,
@@ -93,6 +101,7 @@ export function describeBashExternalDirectoryGate(
     agentName: tcc.agentName,
     toolName: tcc.toolName,
     matchedPattern: preCheck.matchedPattern,
+    surface,
   });
 
   const patterns = uncoveredEntries.map(({ path }) =>
@@ -100,17 +109,20 @@ export function describeBashExternalDirectoryGate(
   );
 
   return {
-    surface: "external_directory",
+    surface,
     input: {},
     payload,
-    sessionApproval: SessionApproval.multiple("external_directory", patterns),
+    sessionApproval: SessionApproval.multiple(
+      approvalSurfaceFor(uncoveredEntries),
+      patterns,
+    ),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       command,
-      accessIntent: accessFactsFromPath("external_directory", worstEntry.path),
+      accessIntent: accessFactsFromPath(surface, worstEntry.path),
     },
     logContext: {
       source: "tool_call",
@@ -119,11 +131,32 @@ export function describeBashExternalDirectoryGate(
       agentName: tcc.agentName,
       command,
       externalPaths: uncoveredPaths,
+      // The blame line ADR 0013 §7 asks for: `request.surface` already records
+      // the direction, and these two record what established it.
+      effect: worstEntry.effect.effect,
+      effectSource: worstEntry.effect.source,
     },
     decision: {
-      surface: "external_directory",
+      surface,
       value: command,
     },
     preCheck,
   };
 }
+
+/**
+ * The surface one session approval can carry for every uncovered path at once.
+ *
+ * A {@link SessionApproval} holds one surface for all its patterns, so it can
+ * narrow only when the whole ask agrees on a direction. The bare family is the
+ * fallback because it sugar-expands onto both members — exactly the width a
+ * mixed-direction command is granted today, never wider.
+ */
+function approvalSurfaceFor(
+  uncoveredEntries: readonly { readonly surface: string }[],
+): string {
+  const surfaces = new Set(uncoveredEntries.map(({ surface }) => surface));
+  return surfaces.size === 1
+    ? [...surfaces][0]
+    : ("external_directory" as const);
+}

package/src/handlers/gates/bash-path-extractor.ts

@@ -4,7 +4,7 @@ import type { PathNormalizer } from "#src/path-normalizer";
 /**
  * Extract paths from a bash command that resolve outside CWD.
  *
- * Thin facade over {@link BashProgram.externalPaths}; parses the command
+ * Thin facade over {@link BashProgram.externalAccesses}; parses the command
  * through the injected {@link PathNormalizer} (platform + cwd baked in) and
  * returns the cd-aware external paths in their lexical (as-typed) string form.
  * See `BashProgram` for the parsing and resolution semantics.
@@ -18,6 +18,6 @@ export async function extractExternalPathsFromBashCommand(
   normalizer: PathNormalizer,
 ): Promise<string[]> {
   return (await BashProgram.parse(command, normalizer))
-    .externalPaths()
-    .map((p) => p.value());
+    .externalAccesses()
+    .map(({ path }) => path.value());
 }

package/src/handlers/gates/bash-path.ts

@@ -1,11 +1,13 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import type { BashProgram } from "#src/access-intent/bash/program";
+import type { TokenEffect } from "#src/access-intent/effect";
+import { capabilitySurfaceForEffect } from "#src/access-intent/path-surfaces";
 import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
+import { pickMostRestrictive } from "#src/restrictiveness";
 import { SessionApproval } from "#src/session-approval";
 import type { PermissionCheckResult } from "#src/types";
-import { pickMostRestrictive } from "./candidate-check";
 import type { GateResult } from "./descriptor";
 import { accessFactsFromPath } from "./helpers";
 import type { ToolCallContext } from "./types";
@@ -15,10 +17,17 @@ import type { ToolCallContext } from "./types";
  *
  * Reads path-rule candidates from the injected `BashProgram` (the broader
  * `path`-rule filter, accepting dot-files and relative paths). Each candidate
- * pairs the raw token with cd-aware policy values; the gate evaluates those
- * values against the `path` permission surface and returns the most
- * restrictive result, while prompts, logs, and session approvals use the raw
- * token.
+ * pairs the raw token with cd-aware policy values and the effect its position
+ * proved; the gate evaluates those values against the narrowest `path`-family
+ * surface that effect names and returns the most restrictive result, while
+ * prompts, logs, and session approvals use the raw token.
+ *
+ * A proven read resolves on `path_read`, a proven write on `path_write`, and
+ * an unproven token on the bare family, whose two members the resolver folds
+ * most-restrictive (ADR 0013 §10). The deciding token's surface is the one the
+ * descriptor, the payload, the access facts, the decision, and the session
+ * approval all carry — a session grant is never wider than what the gate
+ * proved.
  *
  * Returns `null` when the gate does not apply (not a shell invocation, no
  * command, no tokens extracted, or all tokens evaluate to `allow`).
@@ -48,14 +57,17 @@ export function describeBashPathGate(
   const uncovered: Array<{
     token: string;
     path: AccessPath;
+    surface: string;
+    effect: TokenEffect;
     check: PermissionCheckResult;
   }> = [];
   let allSessionCovered = true;
 
-  for (const { token, path } of candidates) {
+  for (const { token, path, effect } of candidates) {
+    const surface = capabilitySurfaceForEffect("path", effect.effect);
     const check = resolver.resolve({
       kind: "access-path",
-      surface: "path",
+      surface,
       path,
       agentName: tcc.agentName ?? undefined,
     });
@@ -73,11 +85,11 @@ export function describeBashPathGate(
     }
 
     if (check.state === "deny") {
-      uncovered.push({ token, path, check });
+      uncovered.push({ token, path, surface, effect, check });
       break; // Short-circuit on deny.
     }
     if (check.state === "ask") {
-      uncovered.push({ token, path, check });
+      uncovered.push({ token, path, surface, effect, check });
     }
   }
 
@@ -122,25 +134,27 @@ export function describeBashPathGate(
   // path), so it matches the values a later call produces. For an unknown base
   // (`forLiteral`) `value()` is the raw token.
   const pattern = normalizer.approvalPatternFor(worstEntry.path);
+  const surface = worstEntry.surface;
   const payload = buildPathAskPayload({
     toolName: tcc.toolName,
     pathValue: worstToken,
     agentName: tcc.agentName,
     matchedPattern: worstCheck.matchedPattern,
+    surface,
   });
 
   return {
-    surface: "path",
+    surface,
     input: { path: worstToken },
     payload,
-    sessionApproval: SessionApproval.single("path", pattern),
+    sessionApproval: SessionApproval.single(surface, pattern),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       command,
-      accessIntent: accessFactsFromPath("path", worstEntry.path),
+      accessIntent: accessFactsFromPath(surface, worstEntry.path),
     },
     logContext: {
       source: "tool_call",
@@ -149,9 +163,13 @@ export function describeBashPathGate(
       agentName: tcc.agentName,
       command,
       path: worstToken,
+      // The blame line ADR 0013 §7 asks for: `request.surface` already records
+      // the direction, and these two record what established it.
+      effect: worstEntry.effect.effect,
+      effectSource: worstEntry.effect.source,
     },
     decision: {
-      surface: "path",
+      surface,
       value: worstToken,
     },
     preCheck: worstCheck,

package/src/handlers/gates/external-directory-policy.ts

@@ -1,11 +1,18 @@
 import type { AccessPath } from "#src/access-intent/access-path";
+import type { BashExternalPath } from "#src/access-intent/bash/bash-path-resolver";
+import type { TokenEffect } from "#src/access-intent/effect";
+import { capabilitySurfaceForEffect } from "#src/access-intent/path-surfaces";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import { pickMostRestrictive } from "#src/restrictiveness";
 import type { PermissionCheckResult } from "#src/types";
-import { pickMostRestrictive } from "./candidate-check";
 
 /** An external path whose resolved `external_directory` state is not "allow". */
 export interface UncoveredExternalPath {
   path: AccessPath;
+  /** The family member the path's own effect named, and the check answered. */
+  surface: string;
+  /** What the effect was, and what established it — the review log's blame. */
+  effect: TokenEffect;
   check: PermissionCheckResult;
 }
 
@@ -17,7 +24,11 @@ export interface UncoveredExternalPaths {
 }
 
 /**
- * Resolve one external path's policy on the `external_directory` surface.
+ * Resolve one external path's policy on an `external_directory`-family surface.
+ *
+ * `surface` is the narrowest family member the caller can prove — the bare
+ * family name when it can prove nothing narrower, which the resolver folds
+ * over both directions (ADR 0013 §10).
  *
  * Emits an `access-path` {@link AccessIntent}; the resolver unwraps it via
  * {@link AccessPath.matchValues} so a config pattern on either the typed or
@@ -28,35 +39,48 @@ export interface UncoveredExternalPaths {
 export function resolveExternalDirectoryPolicy(
   path: AccessPath,
   resolver: ScopedPermissionResolver,
+  surface: string,
   agentName: string | undefined,
 ): PermissionCheckResult {
   return resolver.resolve({
     kind: "access-path",
-    surface: "external_directory",
+    surface,
     path,
     agentName,
   });
 }
 
 /**
- * Resolve a set of external paths and select those not already allowed.
+ * Resolve a set of external accesses and select those not already allowed.
  *
- * Each path is resolved via {@link resolveExternalDirectoryPolicy}; entries
- * whose state is not "allow" are collected (filtering on state, not source, so
- * config-level allow rules suppress the prompt just as session-level allow
- * rules do), and the most restrictive uncovered check is returned so a config
- * "deny" is not downgraded to the catch-all "ask".
+ * Each access is resolved via {@link resolveExternalDirectoryPolicy} on the
+ * narrowest family member its own effect names — a proven read on
+ * `external_directory_read`, an unproven one on the bare family, which the
+ * resolver folds over both directions (ADR 0013 §10). Entries whose state is
+ * not "allow" are collected (filtering on state, not source, so config-level
+ * allow rules suppress the prompt just as session-level allow rules do), and
+ * the most restrictive uncovered check is returned so a config "deny" is not
+ * downgraded to the catch-all "ask".
  */
 export function selectUncoveredExternalPaths(
-  paths: readonly AccessPath[],
+  accesses: readonly BashExternalPath[],
   resolver: ScopedPermissionResolver,
   agentName: string | undefined,
 ): UncoveredExternalPaths {
   const uncovered: UncoveredExternalPath[] = [];
-  for (const path of paths) {
-    const check = resolveExternalDirectoryPolicy(path, resolver, agentName);
+  for (const { path, effect } of accesses) {
+    const surface = capabilitySurfaceForEffect(
+      "external_directory",
+      effect.effect,
+    );
+    const check = resolveExternalDirectoryPolicy(
+      path,
+      resolver,
+      surface,
+      agentName,
+    );
     if (check.state !== "allow") {
-      uncovered.push({ path, check });
+      uncovered.push({ path, surface, effect, check });
     }
   }
   return {

package/src/handlers/gates/external-directory.ts

@@ -1,3 +1,4 @@
+import { capabilitySurfaceForTool } from "#src/access-intent/path-surfaces";
 import { getToolInputPath } from "#src/access-intent/tool-input-path";
 import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
@@ -71,10 +72,15 @@ export function describeExternalDirectoryGate(
   // ── Build descriptor for permission check ───────────────────────────────
   const resolvedAlias = accessPath.resolvedAlias();
 
+  // The narrowest `external_directory`-family surface this tool's identity
+  // proves; the bare family name folds both directions (ADR 0013 §10).
+  const surface = capabilitySurfaceForTool("external_directory", tcc.toolName);
+
   // The runner consumes this preCheck and skips its own resolve.
   const preCheck = resolveExternalDirectoryPolicy(
     accessPath,
     resolver,
+    surface,
     tcc.agentName ?? undefined,
   );
   const pattern = normalizer.approvalPatternFor(accessPath);
@@ -86,21 +92,22 @@ export function describeExternalDirectoryGate(
     cwd: tcc.cwd,
     agentName: tcc.agentName,
     matchedPattern: preCheck.matchedPattern,
+    surface,
   });
 
   return {
-    surface: "external_directory",
+    surface,
     input: {},
     preCheck,
     payload,
-    sessionApproval: SessionApproval.single("external_directory", pattern),
+    sessionApproval: SessionApproval.single(surface, pattern),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       path: externalDirectoryPath,
-      accessIntent: accessFactsFromPath("external_directory", accessPath),
+      accessIntent: accessFactsFromPath(surface, accessPath),
     },
     logContext: {
       source: "tool_call",
@@ -110,7 +117,7 @@ export function describeExternalDirectoryGate(
       path: externalDirectoryPath,
     },
     decision: {
-      surface: "external_directory",
+      surface,
       value: externalDirectoryPath,
     },
   };

package/src/handlers/gates/path.ts

@@ -1,3 +1,4 @@
+import { capabilitySurfaceForTool } from "#src/access-intent/path-surfaces";
 import { getToolInputPath } from "#src/access-intent/tool-input-path";
 import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
@@ -25,13 +26,18 @@ export function describePathGate(
   const filePath = getToolInputPath(tcc.toolName, tcc.input, extractors);
   if (!filePath) return null;
 
+  // The narrowest `path`-family surface this tool's identity proves. A tool
+  // that proves nothing narrower emits the bare family name, which the
+  // resolver folds over both directional members (ADR 0013 §10).
+  const surface = capabilitySurfaceForTool("path", tcc.toolName);
+
   // Emit an access-path intent so the resolver matches the lexical aliases
   // *and* the canonical (symlink-resolved) form, the same set
   // `external_directory` matches (#418, #486).
   const accessPath = normalizer.forPath(filePath);
   const check = resolver.resolve({
     kind: "access-path",
-    surface: "path",
+    surface,
     path: accessPath,
     agentName: tcc.agentName ?? undefined,
   });
@@ -52,20 +58,21 @@ export function describePathGate(
     pathValue: filePath,
     agentName: tcc.agentName,
     matchedPattern: check.matchedPattern,
+    surface,
   });
 
   const descriptor: GateDescriptor = {
-    surface: "path",
+    surface,
     input: { path: filePath },
     payload,
-    sessionApproval: SessionApproval.single("path", pattern),
+    sessionApproval: SessionApproval.single(surface, pattern),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       path: filePath,
-      accessIntent: accessFactsFromPath("path", accessPath),
+      accessIntent: accessFactsFromPath(surface, accessPath),
     },
     logContext: {
       source: "tool_call",
@@ -75,7 +82,7 @@ export function describePathGate(
       path: filePath,
     },
     decision: {
-      surface: "path",
+      surface,
       value: filePath,
     },
     preCheck: check,

package/src/handlers/gates/tool.ts

@@ -132,6 +132,7 @@ export function describeToolGate(
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       ...permissionLogContext,
+      ...floorExemptionFact(check),
     },
     decision: {
       surface: gateSurface,
@@ -139,3 +140,24 @@ export function describeToolGate(
     },
   };
 }
+
+/**
+ * Why a bash wrapper's floor did not apply, when one did not (#803).
+ *
+ * The blame line ADR 0013 §11 asks the review log to record: `matchedPattern`
+ * names the rule that decided and `executedUnit` the command it decided about,
+ * and this names why that rule was consulted instead of the floor. Absent for
+ * every other decision, so a line states what was true rather than enumerating
+ * what was not.
+ *
+ * It rides the gate's `logContext` rather than the prompt payload because an
+ * exempt unit's usual outcome is that no prompt happens at all — the same
+ * routing `effect`/`effectSource` take on the bash path gates.
+ */
+function floorExemptionFact(
+  check: PermissionCheckResult,
+): Record<string, unknown> {
+  return check.floorExemption === undefined
+    ? {}
+    : { floorExemption: check.floorExemption };
+}

package/src/normalize.ts

@@ -1,7 +1,76 @@
+import { surfaceFamilyMembers } from "#src/access-intent/path-surfaces";
 import type { Rule, Ruleset } from "./rule";
-import type { FlatPermissionConfig } from "./types";
+import type { FlatPermissionConfig, PatternValue } from "./types";
 import { isDenyWithReason, isPermissionState } from "./types";
 
+/**
+ * A surface's value in a flat permission config: a catch-all or a pattern map.
+ * `NonNullable` because the four named directional properties are optional.
+ */
+type SurfaceValue = NonNullable<FlatPermissionConfig[string]>;
+
+/** A surface's pattern → action map. */
+type PatternMap = Record<string, PatternValue>;
+
+/**
+ * Rewrite one scope's flat permission object so the bare `path` and
+ * `external_directory` sugar keys are replaced by their directional members
+ * (ADR 0013 §4).
+ *
+ * After expansion **no rule lives on a bare family surface at all** — that is
+ * what makes `PermissionResolver`'s family fold the read path.
+ *
+ * The intra-surface merge order is normative: sugar-derived entries come first
+ * and explicit directional entries append after them, whatever the keys'
+ * textual order in the file, so a config and its key-order-swapped twin mean
+ * the same thing. A pattern the explicit entry redefines is emitted once, at
+ * the explicit entry's position, so last-match-wins gives it the final say.
+ *
+ * Called per scope at load, before composition — so origins stay attributed to
+ * the authoring scope rather than collapsing to `builtin`.
+ */
+export function expandDirectionalSugar(
+  permission: FlatPermissionConfig,
+): FlatPermissionConfig {
+  const expanded: FlatPermissionConfig = {};
+  for (const [surface, value] of Object.entries(permission)) {
+    // A key present with an explicit `undefined` value carries no rules.
+    if (value === undefined) continue;
+    const members = surfaceFamilyMembers(surface);
+    if (members === null) {
+      // A directional key the sugar already absorbed keeps the merged value.
+      if (!Object.hasOwn(expanded, surface)) expanded[surface] = value;
+      continue;
+    }
+    for (const member of members) {
+      expanded[member] = appendExplicitEntries(value, permission[member]);
+    }
+  }
+  return expanded;
+}
+
+/** The sugar-derived entries, followed by the explicit directional entries. */
+function appendExplicitEntries(
+  sugar: SurfaceValue,
+  explicit: SurfaceValue | undefined,
+): SurfaceValue {
+  if (explicit === undefined) {
+    return typeof sugar === "string" ? sugar : { ...sugar };
+  }
+  const explicitPatterns = toPatternMap(explicit);
+  const sugarPatterns = Object.fromEntries(
+    Object.entries(toPatternMap(sugar)).filter(
+      ([pattern]) => !Object.hasOwn(explicitPatterns, pattern),
+    ),
+  );
+  return { ...sugarPatterns, ...explicitPatterns };
+}
+
+/** A catch-all string is shorthand for `{ "*": action }` (see `normalizeFlatConfig`). */
+function toPatternMap(value: SurfaceValue): PatternMap {
+  return typeof value === "string" ? { "*": value } : value;
+}
+
 /**
  * Convert a flat permission config into a Ruleset.
  *

package/src/permission-manager.ts

@@ -1,7 +1,7 @@
 import { join } from "node:path";
 import type { ResolvedAccessIntent } from "./access-intent/access-intent";
 import { normalizeInput } from "./access-intent/input-normalizer";
-import { PATH_SURFACES } from "./access-intent/path-surfaces";
+import { PATH_SURFACES, surfaceFamilyOf } from "./access-intent/path-surfaces";
 import { classifyToolKind } from "./access-intent/tool-kind";
 import {
   getGlobalConfigPath,
@@ -408,7 +408,8 @@ function deriveSource(
   toolName: string,
 ): PermissionCheckResult["source"] {
   if (rule.layer === "session") return "session";
-  if (SPECIAL_PERMISSION_KEYS.has(toolName)) return "special";
+  // Family membership, so a directional surface keeps reporting "special".
+  if (SPECIAL_PERMISSION_KEYS.has(surfaceFamilyOf(toolName))) return "special";
 
   switch (classifyToolKind(toolName)) {
     case "mcp":

package/src/permission-resolver.ts

@@ -3,7 +3,9 @@ import type {
   PathValuesAccessIntent,
   ResolvedAccessIntent,
 } from "./access-intent/access-intent";
+import { surfaceFamilyMembers } from "./access-intent/path-surfaces";
 import type { ScopedPermissionManager } from "./permission-manager";
+import { mostRestrictiveOf } from "./restrictiveness";
 import type { Rule } from "./rule";
 import type { SessionRules } from "./session-rules";
 import type { SkillPermissionChecker } from "./skill-prompt-sanitizer";
@@ -79,14 +81,31 @@ export class PermissionResolver
    * gate-facing {@link ScopedPermissionResolver} interface stays narrow
    * (`AccessIntent` only); this wider acceptance is available only through the
    * concrete `PermissionResolver` instance the composition root holds.
+   *
+   * An intent naming a bare surface family (`path`, `external_directory`) is
+   * folded over the family's directional members, most-restrictive (ADR 0013
+   * §10's fail-closed base case). The fold lives here rather than in the gates
+   * because this is the one entry point the gates, `LocalPermissionsService`,
+   * and `ServingPolicy` all share — a serving node resolving a forwarded child
+   * request against an emptied bare surface would stop hard-denying what the
+   * parent's config denies (the #712 defect class).
    */
   resolve(
     intent: AccessIntent | PathValuesAccessIntent,
   ): PermissionCheckResult {
-    return this.permissionManager.check(
-      toResolvedIntent(intent),
-      this.sessionRules.getRuleset(),
-    );
+    const resolved = toResolvedIntent(intent);
+    const sessionRuleset = this.sessionRules.getRuleset();
+    const members = surfaceFamilyMembers(resolved.surface);
+    if (members === null) {
+      return this.permissionManager.check(resolved, sessionRuleset);
+    }
+    const [first, ...rest] = members;
+    const checkMember = (surface: string): PermissionCheckResult =>
+      this.permissionManager.check({ ...resolved, surface }, sessionRuleset);
+    return mostRestrictiveOf([
+      checkMember(first),
+      ...rest.map((surface) => checkMember(surface)),
+    ]);
   }
 
   /**