Allow actions in this session without asking
Holds one allow rule per entry for the rest of this session’s life on this host, as answering a prompt “allow for this session” holds one: a rule in the grammar of a permissions.toml line whose effect is always allow, at the session scope: above the other scopes, under narya’s floor on writes to its own files. Nothing is stored; they go when the host stops. narya -p --allow sends them before its prompt, which is how an unattended run does the one thing it would otherwise refuse.
The session’s owner alone may call it: a colleague’s answer releases one call. A rule permissions.toml would refuse, or one granting what a deny in the operator’s own permissions.toml refuses, is refused with 422 naming it, and nothing in the list is held.
Autorizações
Enforced on every transport, with no exempt operation. A person's request must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011 — except a request with no token on a laptop's socket from the OS user the kernel names as the host's own, which is that machine's user.
Parâmetros de caminho
The session's id.
Corpo
The allow rules to hold for one session, in the order they apply.
Resposta
Held. The next permission check in this session reads them.

