Organization policy for package risk

Make dependency trust a security control

Set the rules once, enforce them across the org

View the workflow Start With PermJS

Show approval state, ceiling checks, and trace-level override context in one view with clear status styling.

Team workflow

Move from package analysis to org-enforced policy.

Analyze packages

Fetch fingerprints or analyze tarballs to see capability traces, scripts, hashes, and dependency context.

Approve by range

Create semver-scoped approval rules with a capability ceiling and grant constraints.

Use narrow overrides

Target a specific trace, file hash, or function hash instead of broadening the whole package.

Verify on the client

PermJS resolves org policy, verifies signatures locally, and enforces the result in dev workflows and CI.

Show the approvals table, package ranges, capability ceiling columns, and a policy check summary with approved, ceiling exceeded, and not approved states visible.

Controls

Controls that map to the actual policy engine

Control Why it matters

Capability ceilings A version that adds a capability outside the approved ceiling resolves to a violation instead of a silent upgrade.

Grant constraints Approval rules can narrow domains, paths, env keys, and other grants under an approved capability.

Trace-level overrides Overrides can match a specific trace or content-addressed source location instead of widening the package policy.

Org membership and roles Separate owners, admins, and members so review authority stays explicit.

MFA-backed changes Sensitive approval, override, membership, and signing actions can require step-up MFA and recent assurance.

Org key management Upload org keys, serve org keys.json, and sign approvals or overrides for client verification.

Policy as code

Put package decisions in a system the client can enforce.

Security decisions usually live in docs, chat, or one security engineer's memory. PermPM turns those decisions into approvals, ceilings, constraints, and overrides attached to actual package versions and traces.

The policy endpoint resolves global overrides, org approvals, and org overrides in one response. PermJS can then merge that result into the lockfile and enforce it without trusting the registry blindly.

Show trace context, package capability breakdown, approval status, and policy decision UI rather than abstract charts.

Trust chain

Trust chain options

Root of trust for package fingerprints

Fingerprint documents are signed by online keys chained to a root key, giving clients a verifiable source for package analysis.

Org keys for signed approvals and overrides

Organizations can publish their own keys.json, sign approvals and overrides, and rotate keys without depending on the global root.

Local verification on the client side

The CLI verifies keys, fingerprints, and org-signed overrides locally before applying policy.

Show member management, role labels, and an MFA requirement toggle for the organization.

Follow the project as the product solidifies.

PermJS is still pre-release. Join the list for launch updates, new docs, and chances to test the workflow as the CLI and registry mature.