---
{
  "id": "platform.trigger.permissions-and-safety",
  "topic": "trigger",
  "title": "Trigger permissions, public access, and safety",
  "locale": "en",
  "version": "2026-08-10",
  "summary": "Trigger writes are private, list/get permit public reads, destructive lifecycle needs confirmation, and runtime ownership and rate guards remain enforced.",
  "content": "Registry public-surface policy is exact: only `list_triggers` and `get_trigger` allow public reads. Create, update, set-enabled, cancel, deprecated delete, and result recording are not allowed on public surfaces. `cancel_trigger` and `delete_trigger` use `UserConfirm` with strict drift; create, list, get, update, set-enabled, and result recording use no action-level confirmation.\n\nTarget Agent and source resources remain owner-scoped. The user may have at most 100 non-deleted triggers. Matcher defaults are 100 fires per Agent per hour and 100 per source per hour in a 3,600-second window, but deployment configuration is runtime truth. Maximum trigger chain depth is 3; duplicate/debounce and recovery guards still apply. Knowledge cannot weaken redaction, audit, idempotency, permission, or confirmation.\n\n`list_triggers` defaults to active + paused. `includeCancelled: true` widens that default to include cancelled; deleted is always excluded. An explicit `status` filter takes precedence over `includeCancelled`. Use typed runtime results for permission denied, rate limited, conflict, or not found, and never expose private IDs, scopes, event payloads, or `systemMessage` through routing telemetry.\n\nAgent list and get operations are filtered by explicit per-Trigger read/write grants; update, set-enabled, and cancel require write. Missing grants are reported as not found. Permission replacement cannot remove the target Agent's write floor, and immutable replacement copies grants before re-flooring a changed target. These collaboration grants do not alter event delivery, which still targets the configured Agent. Deleting that target Agent retains the existing cascade behavior and deletes the Trigger.\n",
  "aliases": [
    "trigger permission",
    "public trigger read",
    "cancel confirmation",
    "trigger rate limit",
    "includeCancelled",
    "same owner"
  ],
  "tags": [
    "trigger",
    "permission",
    "safety"
  ],
  "relatedActions": [
    "arinova.trigger.create_trigger",
    "arinova.trigger.list_triggers",
    "arinova.trigger.get_trigger",
    "arinova.trigger.update_trigger",
    "arinova.trigger.set_enabled",
    "arinova.trigger.cancel_trigger",
    "arinova.trigger.delete_trigger"
  ],
  "relatedActionPrefixes": [],
  "url": "https://docs.arinova.ai/en/kb/trigger/permissions-and-safety/"
}
---

Registry public-surface policy is exact: only `list_triggers` and `get_trigger` allow public reads. Create, update, set-enabled, cancel, deprecated delete, and result recording are not allowed on public surfaces. `cancel_trigger` and `delete_trigger` use `UserConfirm` with strict drift; create, list, get, update, set-enabled, and result recording use no action-level confirmation.

Target Agent and source resources remain owner-scoped. The user may have at most 100 non-deleted triggers. Matcher defaults are 100 fires per Agent per hour and 100 per source per hour in a 3,600-second window, but deployment configuration is runtime truth. Maximum trigger chain depth is 3; duplicate/debounce and recovery guards still apply. Knowledge cannot weaken redaction, audit, idempotency, permission, or confirmation.

`list_triggers` defaults to active + paused. `includeCancelled: true` widens that default to include cancelled; deleted is always excluded. An explicit `status` filter takes precedence over `includeCancelled`. Use typed runtime results for permission denied, rate limited, conflict, or not found, and never expose private IDs, scopes, event payloads, or `systemMessage` through routing telemetry.

Agent list and get operations are filtered by explicit per-Trigger read/write grants; update, set-enabled, and cancel require write. Missing grants are reported as not found. Permission replacement cannot remove the target Agent's write floor, and immutable replacement copies grants before re-flooring a changed target. These collaboration grants do not alter event delivery, which still targets the configured Agent. Deleting that target Agent retains the existing cascade behavior and deletes the Trigger.