Scoped Permission Grant

Who is asking, why, and exactly what will happen, with four scopes that each say what they cover before you press them. Deny sends a reason back to the agent. Once granted the card folds to one line with a live countdown and Revoke, with Undo for a few seconds. Pass a list of grants and it shows every active one, grouped by agent.

AI Agent ProLifetime access987 lines · one file

The decision inside it

Always means always for this target

"Always allow email.send" is a blank cheque. Here Always covers one target (email.send to @vertically.com) and every other recipient still asks. Allowing any target is a separate choice behind the overflow, marked Wider, and high-risk grants ask for a press and hold.

When to use it

Use Permission Grant when an agent asks for one right on one target: allow once, for an hour or always for this target, or deny with a reason. Pass grants instead to list every active grant with Revoke. For a one-off yes or no on an action use Approval Request.

Installation

How you get it

Paste this into Claude Code, Cursor, Codex or any coding agent. It installs the file and uses it as it is, instead of writing a new one.

Use Layro's Scoped Permission Grant for this.
Install it: npx shadcn@latest add @layro/permission-grant
(the @layro registry is set up in components.json, with LAYRO_KEY in .env.local)
Import it from @/components/ui/permission-grant.
Do not rewrite or restyle it. Pass my data through its props
and keep its built-in states.

For the full brief with every prop and the mistakes assistants usually make, use Copy prompt above. Pro components install through the @layro registry with your CLI token: see the Namespaced tab.

Usage

components/grant-email.tsx

import { PermissionGrant, type GrantScope } from "@/components/ui/permission-grant";

export function GrantEmail({ api }: {
  api: { grant: (scope: GrantScope) => Promise<void>; deny: (reason?: string) => Promise<void>; revoke: () => Promise<void> };
}) {
  return (
    <PermissionGrant
      agent="Renewal agent"
      tool="email.send"
      target="@vertically.com"
      anyTarget="any recipient"
      why="Olivia asked for the signed renewal by email."
      risk="medium"
      onGrant={api.grant}
      onDeny={api.deny}
      onRevoke={api.revoke}
      reasons={["Wrong recipient", "Not yet"]}
    />
  );
}

API reference

“Copy prompt” above puts a full brief on your clipboard — install command, dependencies, props, and the mistakes an assistant usually makes with this component.

Props

Read from the component’s own TypeScript interface when the site is built, so this table cannot drift from the file you install.

Prop	Type	Notes
`grants`	`undefined`	—
`agent`required	`string`	Who is asking: "Renewal agent".
`avatar`	`React.ReactNode`	The agent's mark or avatar. Without one, a plain agent glyph stands in.
`tool`required	`string`	The right it wants: `email.send`.
`toolIcon`	`React.ReactNode`	Optional mark of the app behind the tool (a Gmail logo for `email.send`), shown before its name.
`target`required	`string`	The exact target, shown in mono: "@vertically.com", "/contracts/vertically".
`anyTarget`	`string`	How "any target" reads for this tool: "any recipient". Default "any target".
`why`	`React.ReactNode`	Why, in one sentence from the agent.
`preview`	`React.ReactNode`	Exactly what will happen: a recipient list, a path, an amount.
`risk`	`GrantRisk`	Default `medium`. High asks for a hold before an "Always".
`allowAnyTarget`	`boolean`	Offer "Always for any target" in the overflow. Default true.
`onGrant`	`(scope: GrantScope) => void \| Grant \| Promise<void \| Grant>`	May return a promise, and may resolve with the server's own `expiresAt`.
`onDeny`	`(reason?: string) => void \| Promise<void>`	The reason goes back to the agent. May return a promise.
`onRevoke`	`() => void \| Promise<void>`	May return a promise; the line waits for it and shows any error.
`onRestore`	`(grant: Grant) => void \| Promise<void>`	Undo after a revoke. Default: calls `onGrant` with the same scope.
`grant`	`Grant \| null`	Controlled grant. `null` means none yet; leave it out to let the card keep its own.
`defaultGrant`	`Grant \| null`	—
`onGrantChange`	`(grant: Grant \| null) => void`	—
`reasons`	`string[]`	One-click reasons offered on Deny.

Dependencies

npm packages

clsxframer-motionlucide-reacttailwind-merge

Layro foundations, installed alongside it

layro-themebadgebutton

States

All of them are drawn by the component. None is left for you to design.

Asking
Allowed once
For 1 hour
Always for target
Denied
Expired
Revoked
Grant failed
List

Accessibility

Keyboard reachable throughout, in visual order
Focus trapped in overlays, Escape closes them
Focus returns to whatever opened it
Live regions announce what changed, not that something did
Honours prefers-reduced-motion

Responsive behavior

Sizes to its container, not the viewport
Usable from 320px up
Pointer-based interaction, so trackpad and touch both work
No hover-only affordances

Lifetime access

Every component, and everything we ship next.

All 232 components, source included
Every template, and everything released after you buy
shadcn CLI or download — React 18/19, Tailwind v4
One payment. No subscription.

Get lifetime access — $99 $149 What is included

Inside

Always means always for this target

When to use it

Installation

How you get it

Usage

API reference

Props

Dependencies

States

Accessibility

Responsive behavior

Every component, and everything we ship next.

More in AI AgentAll AI Agent components

Model Picker

Prompt Library

Inline Diff

Sub-agent Tree

Delegate Board

Agent Lanes