Permission reference

Manifest feature	Requirement
dataWorkspaceView surface	data-workspace.read or data-workspace.write
document surface	documents.read or documents.write
chat surface	ai-chat.use
agent-backed chat surface	ai-agents.execute
agent surface	ai-agents.read or ai-agents.write
chat.preset.allowedTools: ['workflow.launch']	workflows.execute
contentScheduler surface	content-scheduler.read or content-scheduler.write
conversations surface	conversations.read or conversations.write
writable conversations surface	conversations.write
knowledge surface	memory.read or memory.write
writable knowledge surface	memory.write

Permissions are deduplicated by defineApp(). Validation occurs again on the server before a plan or deployment is accepted.

:::note Read and write variants A write permission satisfies the corresponding native surface's read requirement. Request the write variant only when the app actually mutates that resource type. :::