# What is a permission envelope in Provely?

> The allow list of tool names and argument values that a person confirmed. The Provely definition, with an example.

Canonical: https://provely.sh/glossary/permission-envelope  
Last reviewed: 2026-09-05  

**A permission envelope is the allow list of tool names and argument values that a person confirmed. Provely derives it from the tool declarations and the confirmed input. The guard refuses a call outside it before the provider receives it.**

Example: a person confirmed a refund of 500 on charge `ch_1001`. The envelope binds the tool `create_refund` and both argument values. A call for 5,000 is refused with the reason code `argument_outside_confirmed_input`.

The envelope is an allow list, not a checklist: the policy states `unlisted: refuse`, so a tool that no list names never runs. Provely closes each derived schema with `additionalProperties: false`, and it marks every argument that no confirmed value bounds REQUIRES_REVIEW.

An envelope answers permission only. It never answers completion, so a permitted call to a provider that no skill covers ends in UNVERIFIABLE with the reason code `outcome_not_compiled`.

## Read next

- [Read the definition of UNVERIFIABLE](https://provely.sh/glossary/unverifiable)
- [Read the definition of MCP server](https://provely.sh/glossary/mcp-server)
- [Read the definition of Guard](https://provely.sh/glossary/guard)
- [Read the definition of REQUIRES_REVIEW](https://provely.sh/glossary/requires-review)
- [See every glossary term](https://provely.sh/glossary)
- [Read how Provely works](https://provely.sh/how-it-works)