Building skelm for TypeScript-native AI agent workflows with enforced permissions

Description and use

The author built skelm to enable developers to write AI agent workflows in TypeScript with strict, enforced permissions. This approach replaces visual editors and advisory prompts with code-based pipelines and structural security boundaries, ensuring that permissions are enforced at the system level rather than relying on the LLM to comply with instructions.

Problem

Existing tools like n8n, OpenClaw, and Hermes did not fit the need for local, TypeScript-native AI agent workflows with real, enforced permission boundaries rather than advisory prompts.

Outcome

The author built skelm to enable developers to write AI agent workflows in TypeScript with strict, enforced permissions. This approach replaces visual editors and advisory prompts with code-based pipelines and structural security boundaries, ensuring that permissions are enforced at the system level rather than relying on the LLM to comply with instructions.

Workflow

• Define workflows as standard TypeScript (.ts) modules using skelm's pipeline primitives (branch, parallel, forEach, loop, wait).
• Utilize Zod for input validation and full TypeScript type checking.
• Run workflows locally via CLI (e.g., skelm run) without requiring a gateway or browser.
• Define structural permissions (fsRead, fsWrite, networkEgress, allowedExecutables) in the workflow code.
• Skelm enforces permissions at three layers: pre-run mapper, backend in-process enforcement, and gateway egress proxy.
• Map high-level permission policies to backend-specific options (e.g., mapping networkEgress: 'deny' to both sandbox-shell restrictions and disabling built-in web_search tools).
• Test workflows using vitest and check into git like standard code.

Evidence

I want to write real .ts modules, use the full TypeScript type system, run vitest, and check my workflows into git like any other code.

Source

Advisory permissions are not a security boundary. They're a politeness request.

Source

Permissions are enforced at the boundary before the backend is called — not in the context window.

Source