Permission Diff

Overview

You send before and after arrays of canonical permission strings. caseSensitivity defaults to SENSITIVE; ASCII_INSENSITIVE lowercases with Locale.ROOT. Optional hierarchyDelimiter plus expandHierarchy=false expands ancestors when true. Results are sorted. This does not decide authorization or look up a directory.

A permission change that both adds and removes grants is not a pure increase.

When to use it

Scope

Non-goals

• Does not decide authorization
• Does not look up a directory
• Does not evaluate wildcards

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"identity.permission_diff","input":{"before":["docs.read"],"after":["docs.read","docs.write"]}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("identity.permission_diff", {"before":["docs.read"],"after":["docs.read","docs.write"]});

Errors

Other limits

Limitations

• Does not decide authorization
• Does not look up a directory
• Does not evaluate wildcards
• Enforcing the resulting set
• Expanding roles from a directory

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "identity.permission_diff",
  "input": {
    "before": [
      "docs.read"
    ],
    "after": [
      "docs.read",
      "docs.write"
    ]
  }
}

Examples

{
  "before": [
    "docs.read"
  ],
  "after": [
    "docs.read",
    "docs.write"
  ]
}

{
  "expandHierarchy": false,
  "unchanged": [
    "docs.read"
  ],
  "addedCount": 1,
  "unchangedCount": 1,
  "removed": [],
  "privilegeChange": "INCREASE",
  "rulesetVersion": "identity.permission_diff.v1",
  "removedCount": 0,
  "added": [
    "docs.write"
  ],
  "caseSensitivity": "SENSITIVE"
}

{
  "before": [
    "docs.read",
    "admin"
  ],
  "after": [
    "docs.write"
  ]
}

{
  "expandHierarchy": false,
  "unchanged": [],
  "addedCount": 1,
  "unchangedCount": 0,
  "removed": [
    "admin",
    "docs.read"
  ],
  "privilegeChange": "MIXED",
  "rulesetVersion": "identity.permission_diff.v1",
  "removedCount": 2,
  "added": [
    "docs.write"
  ],
  "caseSensitivity": "SENSITIVE"
}

Recommended use cases

• Detect an increase when a write grant is added
• Report MIXED when grants both appear and disappear

Avoid for

• Enforcing the resulting set
• Expanding roles from a directory

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags