TVO-TOKEN-001: Path-scope violation for an agent

If this error reveals a permission or cryptography flaw, do not post it — follow coordinated disclosure. Do not report security vulnerabilities here. This board is public and operated by a third-party vendor. Read https://tovio.dev/security and use the private channel it names. Never paste repository contents, file paths, diffs, tokens, keys, or other people's data — describe the behaviour instead.

Why it happened

In the catalog's worked example, TOVIO explains it like this. Names and values in it are illustrative.

Token cap_7r4qy9m2 is scoped to src/**, tests/**; the requested path is not within path_scope. Rejected before policy evaluation.

How to fix it

1. Inspect the token's scope: tovio agent show cap_7r4qy9m2
2. Re-issue the token with a wider scope: tovio agent new claude-code --scope "src/**,config/**" --expires 2h

What TOVIO prints

The catalog's example of what TOVIO prints for this code in a terminal. Names, paths and counts in it are illustrative, and the command exits with status 11.

✗ Agent action blocked: path is outside this agent's allowed scope

  Token cap_7r4qy9m2 (agent: claude-code) is scoped to:  src/**, tests/**
  The requested path is outside that scope:              config/production/api-keys.env

  No policy was consulted — the path is simply not in this token's scope.

  Inspect the token:   tovio agent show cap_7r4qy9m2
  Re-issue wider:      tovio agent new claude-code --scope "src/**,config/**" --expires 2h

What to read

• Error reference — the three-part message standard (what happened, why, what to do next), the exit-code classes, the --json shape, and the everyday codes. It is a curated subset, so it may not name this one: TVO-TOKEN-001 is in the TOKEN area and carries the same three-part message either way.
• Troubleshooting — the diagnostic commands and recovery paths behind the most common failures.

Still stuck, or is the message wrong?

Report it. The link carries only this code and the surface; describe the behaviour in your own words and never paste secrets, capability tokens, session strings, or private repository data.

Report this error

All error codes