Write Policy

MereKit Link is a safe planning tool first. Write authority is declared, narrow, and explicit.

1The config must declare a surface for the target resource.

2The surface must include the matching `policy.writes` capability.

3The operator must pass `--apply` for write-capable command paths.

4Executor writes must also satisfy Link resource guards before invocation.

Dry-run Is The Default

sync projects plans records and links without writing.

mere-link sync projects example-client rollout --config mere.link.yaml --json

The plan includes project payloads, generated links, target workspace, policy surface, and action counts.

Sync Requires Link Policy

Planning and applying Mere Projects sync both require a Mere Projects app surface with policy.writes: [sync].

surfaces:
  projects-app:
    integration: mere
    kind: app
    id: projects
    policy:
      writes: [sync]

That requirement is deliberate: the presence of an app id is not enough to grant write authority.

Apply Is Separate

mere-link sync projects example-client rollout --config mere.link.yaml --apply --json

Existing Mere Projects records are linked without overwriting rich narrative fields.

Executor Writes Need Resource Matches

Executor-backed reads and writes require a declared surface and matching resource arguments. Writes also require compiled Link policy and --apply.

Compiled plans call these local checks resourceGuards. Each guard contains ArgumentPredicate entries such as boardId equals <declared board>, and Link accepts the invocation when a writable surface guard matches the supplied arguments.

mere-link executor invoke write monday.items.update \
  --config mere.link.yaml \
  --data '{"boardId":"1234567890"}' \
  --apply \
  --json

If the board id does not match any declared writable Link surface, Link denies the invocation before the Executor call.

Operator Policy Is A Preflight

Surface policy answers "is this resource allowed for this tool call?" Operator policy answers "is this operator allowed to use this capability for this project?"

mere-link policy evaluate example-client rollout \
  --capability sync.plan \
  --operator approved-agent \
  --json

When operator policy is configured, Link enforces it before exporting context, preparing or applying sync payloads, and invoking runtime tools.