ory-permissions-onboarding
Onboard native agent-tool authorization with default allow and explicit deny overrides. Covers connecting the plugin, reviewing allowed and blocked tools, writing blocks in the Ory Console, and promoting the project from observe to enforce. MCP and PermissionMode remain grant-based.
Install
With your agent
Install OMGSkills skill "ory/claude-plugins:plugins/ory-agent-plugin/skills/ory-permissions-onboarding" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/ory/claude-plugins /tmp/claude-plugins && ln -s /tmp/claude-plugins/plugins/ory-agent-plugin/skills/ory-permissions-onboarding ~/.claude/skills/ory-permissions-onboardingFrom README
Onboard Ory Permissions for Agent Tool Calls Help the user connect Agent Security and roll out explicit native-tool blocks without treating missing grants as denials. The plugin only reads permissions. It never writes them. The permission model, native-tool blocks, MCP grants, and observe/enforce posture are managed in the Ory Console (Agent Security). Native policy is simple: AgentTool and ShellTool have no users relation. Their use permit is !blockedSubjects.includes(subject). No matching block means allowed; a matching block means denied. observe logs the block and proceeds; enforce vetoes the call. MCP permissions and PermissionMode#enforcedSubjects remain grant-based. Connect Agent Security Copy the connection details shown in the Ory Console under Agent Security: Then inspect the resolved configuration: Confirm that Agent Security is connected and the public OAuth2 login client is resolved. The plugin needs no workspace privilege or project API key.
More from this repo
ory-auth-setup
Set up a complete authentication system using Ory Network with Ory Elements as the UI layer.
ory-build-agent
Used to build your own AI agent that authenticates the user, authorizes every tool call against Ory Permissions, and...
ory-build-integration
Wire an Ory Network integration into your own application using the ory/integrates template patterns.