# Permissioned Capability **Domain:** Security / Runtime Design **Doc Type:** Canonical Concept Node **Maturity:** Core Design Principle **Related:** [[wiki/Capability Registry|Capability Registry]], [[wiki/Host Adapter|Host Adapter]], [[wiki/Dynamic Dispatch|Dynamic Dispatch]] --- ## Definition **A permissioned capability is a registered operation whose availability depends on an explicit grant of authority.** Pure transformations may be broadly available; reading files, writing documents, accessing networks, changing account state, or crossing scopes requires narrower authorization. ## XDO Context DO documents should be able to describe intended effects without automatically receiving them. The runtime can display an execution plan, check document and account permissions, constrain targets, and then invoke only the permitted host adapter. ## Key Insight **Describing an action and possessing authority to perform it are separate facts.** ## See Also [[wiki/Intermediate Representation|Intermediate Representation]], [[wiki/Named Target|Named Target]], [[wiki/Error Behavior|Error Behavior]], [[wiki/Technical Terms|Technical Terms]]