Permission Matrix

🔐 Permission Matrix Reference

Complete reference for the CursorRIPER♦Σ permission system, showing what operations are allowed in each mode.

🎯 Permission Overview

CRUD Model

ℙ = {C: create, R: read, U: update, D: delete}

Permission Symbols

Symbol	Meaning	Description
✓	Allowed	Full permission
✗	Forbidden	Not permitted
~	Conditional	Limited/restricted

📊 Master Permission Matrix

Core CRUD Permissions by Mode

Mode	Create (C)	Read (R)	Update (U)	Delete (D)
RESEARCH Ω₁	✗	✓	✗	✗
INNOVATE Ω₂	~	✓	✗	✗
PLAN Ω₃	✓	✓	~	✗
EXECUTE Ω₄	✓	✓	✓	~
REVIEW Ω₅	✗	✓	✗	✗

Detailed Permission Breakdown

ℙ(Ω₁) = {R: ✓, C: ✗, U: ✗, D: ✗}  // Research: Read-only
ℙ(Ω₂) = {R: ✓, C: ~, U: ✗, D: ✗}  // Innovate: Read + conceptual
ℙ(Ω₃) = {R: ✓, C: ✓, U: ~, D: ✗}  // Plan: Read/Create + limited update
ℙ(Ω₄) = {R: ✓, C: ✓, U: ✓, D: ~}  // Execute: Full + limited delete
ℙ(Ω₅) = {R: ✓, C: ✗, U: ✗, D: ✗}  // Review: Read-only

🗂️ File System Permissions

File Operations by Mode

Operation	Research	Innovate	Plan	Execute	Review
Read file	✓	✓	✓	✓	✓
Create file	✗	✗	✓¹	✓	✗
Update file	✗	✗	✓¹	✓	✗
Delete file	✗	✗	✗	✓²	✗
Create directory	✗	✗	✓	✓	✗
List directory	✓	✓	✓	✓	✓

¹ Plan mode: Only plan/specification documents ² Execute mode: With confirmation, no mass deletion

File Type Restrictions

File Type	Research	Innovate	Plan	Execute	Review
Source code	Read	Read	Read	All	Read
Config files	Read	Read	Read	All³	Read
Documentation	Read	Read	Create/Update	All	Read
Test files	Read	Read	Read	All	Read
Binary files	Read	Read	Read	Limited	Read

³ Config files: Extra caution required

💾 Database Permissions

Database Operations by Mode

Operation	Research	Innovate	Plan	Execute	Review
SELECT	✓	✓	✓	✓	✓
INSERT	✗	✗	✗	✓	✗
UPDATE	✗	✗	✗	✓	✗
DELETE	✗	✗	✗	✓⁴	✗
CREATE TABLE	✗	✗	✗	✓	✗
DROP TABLE	✗	✗	✗	✗	✗
ALTER TABLE	✗	✗	✗	✓⁵	✗

⁴ DELETE: Must have WHERE clause ⁵ ALTER: Non-destructive changes only

🌐 External Service Permissions

Service Access by Mode

Service	Research	Innovate	Plan	Execute	Review
Web Search	✓	✓	✓	✗	✓
API Read	✓	✓	✓	✓	✓
API Write	✗	✗	✗	✓	✗
Git Read	✓	✓	✓	✓	✓
Git Write	✗	✗	✗	✓	✗
Package Install	✗	✗	✓⁶	✓	✗

⁶ Plan mode: Only in package.json

Why No Search in Execute?

Execute mode blocks web search to maintain focus on implementation. Complete research before entering Execute mode.

🔄 Operation Categories

Operation Set Permissions

𝕊(Ω₁) = {𝕆ₒᵦₛₑᵣᵥₑ: ✓, 𝕆ᵥᵢᵣₜᵤₐₗ: ~, 𝕆ᵣₑₐₗ: ✗}
𝕊(Ω₂) = {𝕆ₒᵦₛₑᵣᵥₑ: ✓, 𝕆ᵥᵢᵣₜᵤₐₗ: ✓, 𝕆ᵣₑₐₗ: ✗}
𝕊(Ω₃) = {𝕆ₒᵦₛₑᵣᵥₑ: ✓, 𝕆ᵥᵢᵣₜᵤₐₗ: ✓, 𝕆ᵣₑₐₗ: ~}
𝕊(Ω₄) = {𝕆ₒᵦₛₑᵣᵥₑ: ✓, 𝕆ᵥᵢᵣₜᵤₐₗ: ~, 𝕆ᵣₑₐₗ: ✓}
𝕊(Ω₅) = {𝕆ₒᵦₛₑᵣᵥₑ: ✓, 𝕆ᵥᵢᵣₜᵤₐₗ: ~, 𝕆ᵣₑₐₗ: ✗}

Operation Categories Explained

𝕆ₒᵦₛₑᵣᵥₑ (Observation):

• read_files
• analyze_content
• identify_patterns
• review_code

𝕆ᵥᵢᵣₜᵤₐₗ (Virtual/Conceptual):

• suggest_ideas
• explore_concepts
• evaluate_approaches
• design_architecture

𝕆ᵣₑₐₗ (Real/Physical):

• modify_files
• write_code
• delete_content
• refactor

🛡️ Protection Operations

Protection Permissions by Mode

Operation	Research	Innovate	Plan	Execute	Review
View protections	✓	✓	✓	✓	✓
Add protection	✗	✗	✓⁷	✓	✗
Modify protected	✗	✗	✗	✗⁸	✗
Remove protection	✗	✗	✗	✗	✗

⁷ Plan mode: Plan protection strategy only ⁸ Execute mode: Only with explicit approval

Protection Level Enforcement

Protection	Research	Innovate	Plan	Execute	Review
Ψ₁ PROTECTED	Observe	Observe	Observe	Enforce	Verify
Ψ₂ GUARDED	Observe	Observe	Request	Ask	Verify
Ψ₃ INFO	Read	Read	Update	Update	Read
Ψ₄ DEBUG	Observe	Observe	Plan	Modify	Review
Ψ₅ TEST	Observe	Observe	Plan	Modify	Review
Ψ₆ CRITICAL	Observe	Observe	Observe	Enforce	Verify

📎 Context Operations

Context Management by Mode

Operation	Research	Innovate	Plan	Execute	Review
Add context	✓	✓	✓	✓	✓
Remove context	✓	✓	✓	✓	✓
Clear context	✓	✓	✓	✓	✓
Set status	✓	✓	✓	✓	✓
Auto-context	✓	✓	✓	✓	✓

Mode-Specific Context Loading

MΓ[Ω₁] = [Γ₄, Γ₂, Γ₆]  // Research: Docs, Folders, Git
MΓ[Ω₂] = [Γ₃, Γ₄, Γ₇]  // Innovate: Code, Docs, Notepads
MΓ[Ω₃] = [Γ₁, Γ₂, Γ₅]  // Plan: Files, Folders, Rules
MΓ[Ω₄] = [Γ₃, Γ₁, Γ₈]  // Execute: Code, Files, Pinned
MΓ[Ω₅] = [Γ₃, Γ₁, Γ₆]  // Review: Code, Files, Git

💾 Memory File Permissions

Memory Update Permissions

Memory File	Research	Innovate	Plan	Execute	Review
σ₁ projectbrief	Read	Read	Update	Read	Verify
σ₂ systemPatterns	Read	Update	Update	Read	Read
σ₃ techContext	Update	Read	Update	Update	Read
σ₄ activeContext	Update	Update	Update	Update	Update
σ₅ progress	Read	Read	Update	Update	Update
σ₆ protection	Read	Read	Plan	Update	Verify

⚠️ Violation Handling

Violation Severity Matrix

Operation	In Mode	Severity	Response
Write code	Research	HIGH	Block + backup
Delete file	Review	CRITICAL	Block + revert
Web search	Execute	MEDIUM	Block + notify
Modify plan	Execute	HIGH	Block + backup
Fix issue	Review	MEDIUM	Block + suggest

Violation Response Actions

𝕍(op, Ω) = {
  log_violation(op, Ω),      // Always log
  create_backup(),           // If HIGH/CRITICAL
  revert_to_safe_mode(),     // If CRITICAL
  notify_violation(op, Ω)    // Always notify
}

🎯 Common Permission Patterns

Feature Development

RESEARCH: R:✓ only → Gather requirements
INNOVATE: R:✓ C:~ → Design conceptually
PLAN: R:✓ C:✓ → Create specifications
EXECUTE: Full permissions → Implement
REVIEW: R:✓ only → Validate

Bug Fix

RESEARCH: R:✓ → Investigate issue
PLAN: R:✓ C:✓ → Design fix
EXECUTE: R:✓ U:✓ → Apply fix
REVIEW: R:✓ → Verify fix

Refactoring

RESEARCH: R:✓ → Analyze current code
INNOVATE: R:✓ C:~ → Design improvements
PLAN: R:✓ C:✓ → Plan refactor steps
EXECUTE: R:✓ U:✓ D:~ → Refactor code
REVIEW: R:✓ → Ensure functionality

📋 Permission Quick Reference

By Operation Need

Need to...	Required Mode	Permission
Read code	Any mode	R:✓
Write new code	Execute	C:✓
Modify code	Execute	U:✓
Delete code	Execute	D:~
Search web	Not Execute	R:✓
Create plan	Plan	C:✓
Add protection	Execute	C:✓

By Mode Focus

Mode	Primary Permission	Focus
Research	Read	Understanding
Innovate	Read + Virtual	Exploration
Plan	Create specs	Design
Execute	All operations	Implementation
Review	Read	Validation

🔧 Permission Commands

Check Permissions

• !ckp - Current mode permissions
• !pm <operation> - Is operation allowed?
• !sp <mode> - Show mode permissions
• !vm <operation> - Which mode for operation?

Permission Enforcement

if (!check_permission(operation, current_mode)) {
  handle_violation(operation, current_mode);
  return blocked;
}

📚 Related Topics

• Permission System
• Mode Reference
• Violation Protocol
• RIPER Modes

---

← Mode Reference | Home | API Reference →