Permission reference

Manifest feature	Requirement
dataWorkspaceView surface	data-workspace.read or data-workspace.write
document surface	documents.read or documents.write
chat surface	ai-chat.use
chat.preset.allowedTools: ['workflow.launch']	workflows.execute
contentScheduler surface	content-scheduler.read or content-scheduler.write

Permissions are deduplicated by defineApp(). Validation occurs again on the server before a plan or deployment is accepted.

:::note Read and write variants A write permission satisfies the corresponding native surface's read requirement. Request the write variant only when the app actually mutates that resource type. :::