filesystem_get_acl

What filesystem_get_acl does on Nasbridge

AI agents call filesystem_get_acl to retrieve information from Nasbridge without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why filesystem_get_acl is rated Low

This tool queries and returns ACL information for a filesystem path without modifying, deleting, or executing any operations. It is a pure read operation with minimal blast radius — an AI agent could misuse it to enumerate permissions but cannot directly escalate privileges, modify data, or execute commands through this tool alone. Low severity is appropriate for informational reads.

From the tool's definition Tool description explicitly states 'Get the Access Control List (ACL)' — a retrieval operation with no modification or side effects. The word 'Get' and the read-only nature of querying ACL permissions confirms this is a data retrieval action.

The rule that runs filesystem_get_acl safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Nasbridge, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For filesystem_get_acl, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "filesystem_get_acl": {}
  }
}

Questions about filesystem_get_acl