Skip to main content
Every praisonai run now asks before an agent reads .env or a private key, so credentials never leak silently to the model provider.
This gate ships in PraisonAI PR #3256 (fixes #3255). It lives in the core PermissionManager, so it protects every frontend — CLI, YAML, and Python Agent — by default. No new parameters, exports, or config surface.
The default protects you with no configuration — a bare read:* allow rule no longer authorises .env reads.

​
Quick Start

1

Default behaviour

Nothing to configure — the agent asks before reading any secret file:
The run pauses with an approval prompt before the contents ever reach the model.
2

Opt in for a trusted workflow

Pass a secret-specific allow to skip the prompt for that pattern:
3

Harden further

Deny outright so no prompt ever appears:

​
How It Works

The gate matches the file’s basename against a fixed set of secret globs; a match that is not on the safe-doc allow-list defaults to ask. Only two read prefixes are gated:
write:.env is unaffected — only read: / read_file: targets pass through the secret gate. Writing to a .env file behaves exactly as before.

​
What Counts As a Secret

Patterns are matched case-insensitively against the file’s basename, so config/.env and .env both match. Example and template files are never gated (the safe-doc allow-list):
So read:.env.example, read:config/.env.template, and read:settings.example are always allowed.

​
Overriding the Default

Users can opt in, harden, or approve at the prompt — pick the path that fits the workflow. Precedence, highest first:
A broad read:* allow does not authorise secret reads on its own. The gate falls through to ask. To opt in, use a secret-specific rule such as read:*.env.
The prompt emits this exact reason string — grep for it:

​
Interaction Flow

A default run asks once before the contents are forwarded:
An opt-in run skips the prompt entirely:

​
Common Patterns

CLI opt-in for a single trusted run:
YAML policy block — secret-specific opt-in, hardening, and a broad allow that does not cover secrets:
Python PermissionRule:
write:.env is not affected by the gate — only reads are gated. A write:*.env rule behaves exactly as it did before.

​
Best Practices

Use read:*.env or read:id_rsa to opt in to a specific secret. A broad read:* intentionally does not cover secrets, so relying on it will still prompt.
For any agent a person interacts with, keep the ask default. The one-shot prompt is the last line of defence against silent credential exfiltration.
Unattended CI runners should never read secrets. Add read:*.env → deny (and read:*.pem → deny) so the operation is blocked outright with no prompt.
*.env.example, *.env.template, and *.sample files pass straight through. Documentation and onboarding flows that read these are unaffected.

Permissions

Programmatic PermissionManager API and rule patterns

Permissions CLI

Manage allow/deny rules from the command line

Declarative Permissions

YAML, CLI, and Python permission policies

Workspace Boundary

Sibling core default — gate access outside the project root