permission posture 'never' is not part of the Runtime produc

Error message

permission posture 'never' is not part of the Runtime product contract

What it means

RuntimePolicy::new maps a configured permission posture string to an ApprovalMode, and 'never' (ApprovalMode::Never) is explicitly rejected with 'permission posture never is not part of the Runtime product contract'. The runtime must always be able to take at least some action; a posture that denies everything has no valid runtime semantics, so it is a configuration error rather than a supported mode.

Source

Thrown at crates/tui/src/runtime_policy.rs:67

        permission_posture: Option<&str>,
        auto_approve: Option<bool>,
    ) -> Result<Self> {
        let parsed_mode = parse_runtime_mode(mode).ok_or_else(|| {
            anyhow::anyhow!("unsupported Runtime mode {mode:?}; expected plan, act, or operate")
        })?;
        let permission = match permission_posture {
            Some(value) => ApprovalMode::from_config_value(value).ok_or_else(|| {
                anyhow::anyhow!(
                    "unsupported permission posture {value:?}; expected ask, auto-review, or full-access"
                )
            })?,
            None if parsed_mode == AppMode::Yolo || auto_approve.unwrap_or(false) => {
                ApprovalMode::Bypass
            }
            None => ApprovalMode::Suggest,
        };
        if permission == ApprovalMode::Never {
            bail!("permission posture 'never' is not part of the Runtime product contract");
        }
        Ok(Self {
            mode: visible_mode(parsed_mode),
            permission,
        })
    }

    #[must_use]
    pub(crate) fn mode_setting(self) -> &'static str {
        self.mode.as_setting()
    }

    #[must_use]
    pub(crate) fn permission_wire(self) -> &'static str {
        match self.permission {
            ApprovalMode::Suggest => "ask",
            ApprovalMode::Auto => "auto_review",
            ApprovalMode::Bypass => "full_access",

View on GitHub (pinned to 0c42157ee5)

Solutions

Change the posture to one of the supported values: ask, auto-review, or full-access.
If the goal is maximum safety, use 'ask' so every action still requires approval.
Search the config for the key that produced the value (the preceding 'unsupported permission posture' error names the raw value) and fix it at the source.

Example fix

# before (config)
permission-posture = "never"   # bails: not part of the Runtime product contract

# after (config)
permission-posture = "ask"

Defensive patterns

Strategy: validation

Validate before calling

// Rust: accept only documented postures before building the policy
const SUPPORTED_POSTURES: &[&str] = &["ask", "auto-review", "full-access"];

let posture = config.permission_posture.as_deref().unwrap_or("ask");
anyhow::ensure!(
    SUPPORTED_POSTURES.contains(&posture),
    "unsupported permission posture {posture:?}; expected one of {SUPPORTED_POSTURES:?}"
);
let policy = RuntimePolicy::new(mode, Some(posture), None)?;

Prevention

Validate posture strings against the documented allowlist at config load time, not at runtime startup.
Remember 'never' is intentionally unsupported: use 'ask' for maximum restriction.
Add a config schema/lint step in CI to catch invalid enum values early.

When it happens

Trigger: Constructing RuntimePolicy with permission_posture resolving to 'never' (via ApprovalMode::from_config_value), e.g. a config file or CLI flag setting permission/permission-posture to never while launching the runtime.

Common situations: Hardening pass sets permissions to the most restrictive sounding value; users assume ask/auto-review/full-access/never is a uniform ladder; copying a policy file from another tool where 'never' meant 'ask every time'.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/a4882f49bce747d1. Report an issue: GitHub.