{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=himanshu-jha/effective-permission-toxic-chain@0.1.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/himanshu-jha/effective-permission-toxic-chain@0.1.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/himanshu-jha/effective-permission-toxic-chain@0.1.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/himanshu-jha/effective-permission-toxic-chain@0.1.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Computes effective permissions from a portable authorization snapshot instead of reviewing grants one row at a time. Use it for recurring access reviews and after every role, group, inheritance, or policy change. Four independent probes expand transitive group membership, evaluate inherited allow/deny and wildcard rules, detect toxic permission pairs, and construct principal-to-action witness paths; wildcard actions expand from concrete catalog, toxic-pair, privileged, and matched-rule actions, while an unexpandable wildcard is INDETERMINATE and never silently CLEAR. A synthesis join returns severity-prioritized remediation and refuses a clean result if any required dimension is absent. Duplicate principal/group/resource IDs, unknown parent references, and cyclic resource hierarchies fail closed before any grant is evaluated, so malformed topology cannot produce CLEAR. It reads JSON only, writes nothing, and calls no provider. Run with input=snapshots/access.json or omit input for the bundled demo. Limits: th","distribution":{"digest":"sha256:c79c9218d2d7f90a7160869c24353015d9ec8e582783a962d4bae04edd9e0754","mediaType":"application/vnd.modiqo.rote-flow","size":12946,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/himanshu-jha/effective-permission-toxic-chain@0.1.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"license":"MIT","links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/himanshu-jha/effective-permission-toxic-chain@0.1.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/himanshu-jha/effective-permission-toxic-chain@0.1.0.json"},"name":"effective-permission-toxic-chain","owner":{"kind":"org","slug":"himanshu-jha"},"parameters":[{"description":"Workspace-relative authorization snapshot JSON. Omit for the bundled demo; pass input=snapshots/tenant-access.json to analyze fresh grants.","example":"snapshots/tenant-access.json","input":{"allowCustom":true,"choices":[],"label":"Input"},"name":"input","required":false,"type":"string"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/himanshu-jha/effective-permission-toxic-chain@0.1.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/himanshu-jha/effective-permission-toxic-chain@0.1.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/himanshu-jha/effective-permission-toxic-chain@0.1.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.78.0"},"publishedAt":"2026-09-04T12:22:20.526649+00:00","reference":"himanshu-jha/effective-permission-toxic-chain@0.1.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["python3"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":3,"installs":0},"steps":{"count":5,"names":["construct_permission_witnesses","detect_toxic_permission_pairs","evaluate_inherited_wildcards","expand_identity_closure","synthesize_effective_permission_risk"]},"title":"effective-permission-toxic-chain","type":"play","version":"0.1.0","visibility":"public"}