{"record":{"id":"5aecbd83e00de8e5","repo":"Hmbown/CodeWhale","slug":"agent-profile-may-not-request-trust-true","errorCode":null,"errorMessage":"agent profile {} may not request trust=true","messagePattern":"agent profile (.+?) may not request trust=true","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/fleet/profile.rs","lineNumber":448,"sourceCode":"    {\n        match posture {\n            \"read-only\" | \"readonly\" | \"read_only\" => {}\n            other => bail!(\n                \"agent profile {} tools.posture={other:?} would widen permissions; use FleetProfile policy for grants\",\n                path.display()\n            ),\n        }\n    }\n\n    if let Some(permissions) = permissions {\n        if permissions.allow_shell.unwrap_or(false) {\n            bail!(\n                \"agent profile {} may not request allow_shell=true\",\n                path.display()\n            );\n        }\n        if permissions.trust.unwrap_or(false) {\n            bail!(\n                \"agent profile {} may not request trust=true\",\n                path.display()\n            );\n        }\n        if permissions.approval_required == Some(false) {\n            bail!(\n                \"agent profile {} may not disable approval_required\",\n                path.display()\n            );\n        }\n    }\n    Ok(())\n}\n\nfn validate_agent_profile_token(path: &Path, field: &str, value: &str) -> Result<()> {\n    let trimmed = value.trim();\n    if trimmed.is_empty() {\n        bail!(\"agent profile {} {field} cannot be empty\", path.display());","sourceCodeStart":430,"sourceCodeEnd":466,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/fleet/profile.rs#L430-L466","documentation":"Agent profile files may not request permissions.trust = true. Trust marks content or outputs as trusted and is a privileged grant; allowing profiles to self-declare it would let any worker escalate, so the loader rejects the file. Absent flags default to false and are accepted.","triggerScenarios":"An agent profile TOML containing [permissions] trust = true.","commonSituations":"Attempting to suppress approval prompts by marking a profile trusted; porting profiles from tooling where trust was per-agent; misunderstanding trust as a benign convenience flag.","solutions":["Remove trust (or set it to false) from the profile's [permissions] block","Configure trust centrally in the FleetProfile policy if and only where required","Keep approval_required enabled for profiles that operate on untrusted input"],"exampleFix":"# before\n[permissions]\ntrust = true\n\n# after\n[permissions]\ntrust = false","handlingStrategy":"validation","validationCode":"fn profile_permissions_ok(permissions: &Option<AgentProfilePermissionsToml>) -> bool {\n    permissions\n        .as_ref()\n        .map(|p| !p.trust.unwrap_or(false))\n        .unwrap_or(true)\n}","typeGuard":null,"tryCatchPattern":"if let Err(err) = load_agent_profile_file(&path) {\n    if err.to_string().contains(\"trust=true\") {\n        eprintln!(\"remove trust from the profile; configure trust centrally via FleetProfile policy\");\n    }\n    return Err(err.into());\n}","preventionTips":["Treat trust as a centrally managed grant, never a profile-level convenience","Keep approval_required enabled for profiles handling untrusted input","Grep profile directories for trust/allow_shell before shipping config changes"],"tags":["fleet","agent-profiles","permissions","security","configuration","rust","codewhale"],"backgroundTag":"permission-escalation-rejected","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}