Introduces a dedicated review_gate_bypass permission-policy category so operators can govern who may bypass a failed pre-merge review gate independently of ordinary task-mutation permissions.
- Add review_gate_bypass as a new sensitive-action category in packages/core/src/types.ts, distinct from task_agent_mutation, with fn_task_bypass_review as its sole example tool
- Default review_gate_bypass to require-approval even under the unrestricted preset (stricter than the preset's uniform disposition) in packages/core/src/agent-permission-policy.ts, while approval-required/locked-down already cover it uniformly
- Classify fn_task_bypass_review into the new category via a shared REVIEW_GATE_BYPASS_FN_TOOLS set in packages/engine/src/gating-classifications.ts, consumed identically by both evaluateAgentActionGate and the permanent-agent gate to prevent path drift
- Render the new category as its own row in the dashboard's project-default and per-agent AgentPermissionPolicyEditor, surfaced in AgentDetailView
- Update docs/settings-reference.md and add unit tests across core/engine/dashboard covering the new category, its stricter default, and gate-classification alignment
- Add changeset (@runfusion/fusion: minor) documenting the new operator-facing permission category
Files changed:
.changeset/fn-7728-review-gate-bypass-rbac.md | 7 +++
docs/settings-reference.md | 8 +--
.../src/__tests__/agent-permission-policy.test.ts | 54 ++++++++++++++++++-
packages/core/src/agent-permission-policy.ts | 12 ++++-
packages/core/src/types.ts | 8 +++
.../dashboard/app/components/AgentDetailView.tsx | 2 +
.../app/components/AgentPermissionPolicyEditor.tsx | 8 +++
.../__tests__/AgentPermissionPolicyEditor.test.tsx | 5 ++
.../engine/src/__tests__/agent-action-gate.test.ts | 45 ++++++++++++++++
.../src/__tests__/gating-classifications.test.ts | 63 ++++++++++++++++++++++
.../src/__tests__/permanent-agent-gating.test.ts | 41 ++++++++++++++
packages/engine/src/agent-action-gate.ts | 7 +++
packages/engine/src/gating-classifications.ts | 8 ++-
packages/engine/src/permanent-agent-gating.ts | 6 +++
14 files changed, 266 insertions(+), 8 deletions(-)
Fusion-Task-Id: FN-7728
Fusion-Task-Lineage: 100c8563-2897-4d53-9546-5c2faa6ab7d8
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
d44dbaab15