Permissions and account profiles

Installation is one package version per environment. Enablement, toolbar ordering, grants, and account profile assignments are independent project controls.

Declare only required capabilities in the manifest. Users grant each privileged capability separately per project. A shared account profile does not automatically grant project access.

Named Work/Personal profiles have separate credentials and data. Shared profiles deliberately share non-secret profile storage across assigned projects. Project-isolated profiles keep separate namespaces for each project. Assigning another profile never merges its data.

Store non-secret values through the storage bridge; put service tokens in host-managed credential settings. Tokens are encrypted with OS-backed safe storage. Never embed credentials in packaged source. Linux insecure basic_text credential storage is refused.

The publisher's GitHub account and registry download tokens are not an extension account profile. Registry credentials must not be exposed through the extension bridge.

Permission denial, disabled tools, project changes, and stale requests must fail visibly. A request already delivered to a remote service cannot be undone by revoking its grant.