Source: https://reporules.fyi/ring/session-permission-boundary/

# Keep Ring mutation permissions at the request handler: Perch rule pack

1 saved requirement for Ring. Inspect the selectors and adapt the example paths to your repository.

```
- name: ring-write-permission
  where: "src/shop/orders.clj"
  ensure: >-
    The handler must reject a session actor without :orders/write before calling cancel-pending.
```

[Download the rule pack ZIP](https://reporules.fyi/ring/session-permission-boundary/rule-pack.zip) · [Download YAML](https://reporules.fyi/ring/session-permission-boundary/rules.yaml) · [Agent repair task](https://reporules.fyi/ring/session-permission-boundary/agent-task.txt) · [Implementation, integration requirements and captured checks](https://frameworkrecipes.dev/ring/session-permission-boundary/)

## Install the rule without replacing your configuration

```
npm install -g @lakeday/perch
perch login
curl -fL 'https://reporules.fyi/ring/session-permission-boundary/rule-pack.zip' -o 'perch-guide-ring-session-permission-boundary.zip'
unzip -n 'perch-guide-ring-session-permission-boundary.zip'
```

Keep your existing perch.yaml. Extraction preserves existing files and adds .perch/rules/perch-guide-ring-session-permission-boundary.yaml. Review each where selector before running a check on your application.

## Configure your coding agent

```
perch setup claude-code
perch setup codex
perch setup cursor
perch setup pi
```

Choose the setup command for the agent you use.

## Check the edit, fix the finding, check again

```
perch check src/shop/orders.clj --rules ring-write-permission --json
```

Run the check after an agent edit. Read the finding and affected code, repair the implementation, and repeat the identical command. Keep the application regression tests as separate gates.

Exit 3 means a finding. Exit 1 or 2 means the check did not complete. A pass does not prove application correctness. Fresh judgments can vary; unchanged requests reuse cached answers. Relevant source is sent to the configured model service.

[Pack manifest and SHA-256 hash](https://reporules.fyi/ring/session-permission-boundary/rule-pack.json) · [Pack README](https://reporules.fyi/ring/session-permission-boundary/rule-pack-readme.md)

**Repo Rules**

Requirements that stay in the repo.

Published by Perch · © 2026 Verglas LLC. Repo Rules is a Perch publication.

Perch’s MIT license covers the CLI; hosted model analysis is a paid service. Relevant source is sent to the configured model service.

[Perch CLI MIT license](https://github.com/lakeday-org/perch/blob/main/LICENSE) · [Article text](https://reporules.fyi/ring/session-permission-boundary/index.md) · [Resource index](https://reporules.fyi/llms.txt)