---
title: Capabilities and review
description: Declare the access your plugin needs. The user decides what to grant.
group: Build
---

# Capabilities and review

The manifest lists requested capabilities. Installing a package grants none. Users enable access in **Plugins / Installed**, and can revoke it later. Hay checks the current plugin identity, task ownership, and grants at each operation.

Hay account sign-in is a host-level prerequisite for app access, not a plugin capability. It does not grant model, storage, browser or coding access. No capability exposes the account’s verification code or session token.

## Capability reference

| Capability | Supported access |
| --- | --- |
| `storage` | `storage.get`, `storage.set`, `sources.list`, and `outputs.*`. |
| `files.read` | `documents.list`; only documents explicitly imported for the plugin. |
| `models.invoke` | `agent.run`, `models.generate`; also required to execute a coding run. Permitted context goes to the selected provider. |
| `browser.read` | `browser.open`; request approval to open a URL and return visible text. |
| `browser.control` | `browser.create`, `sessions`, `observe`, `act`, `screenshot`, `close`, and browser change events. |
| `github.read` | Approved public GitHub.com PR snapshots through `github.readPullRequest`. |
| `github.private.read` | Private PR reads, in addition to `github.read`, a host-managed account connection, an allowed repository, and approval. |
| `coding.read` | `coding.project`, `readFile`, `list`, `get`, `review`; preview also needs `browser.control`. |
| `coding.run` | `coding.createSpec`, `run`, `wait`, `stop`; coding-spec output handoff. A run also needs `models.invoke`. |
| `coding.commit` | Request `coding.commit` and `coding.integrate` after user review. |

## A grant is not blanket approval

A granted browser or coding capability makes the corresponding service available. Navigations, browser actions, coding execution, output handoffs, commits, and integration can still need a concrete host review. Plugins cannot dismiss or approve these requests themselves.

Hay presents requests inline in the originating conversation. A pending request does not block other replies. A user can stop a task or decline the request; the plugin must handle rejection.

## Model access

Model access sends the plugin’s prompts and explicitly permitted context to the workspace’s selected model provider. That provider’s data policy applies. A browser tab or local document is not automatically model context for every request.

No verified zero-data-retention route is configured in the current desktop implementation. A workspace requiring such a route blocks inference rather than silently choosing another provider.

## Revocation and ownership

Pausing, uninstalling, or revoking access stops owned work where appropriate. A plugin cannot read another plugin’s namespace, claim another task’s output by guessing an ID, or choose a new filesystem root. Host-managed credentials never appear in plugin messages or results.