# Explicit Permissions for Node-RED: No More Blind Trust in Packages

**URL:** <https://discourse.nodered.org/t/explicit-permissions-for-node-red-no-more-blind-trust-in-packages/100598>\
**Category:** General\
**Created:** [19 March 2026 00:51 UTC](https://discourse.nodered.org/t/explicit-permissions-for-node-red-no-more-blind-trust-in-packages/100598 "2026-03-19T00:51:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![AllanOricil](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/allanoricil/32/106911_2.png) [@AllanOricil](https://discourse.nodered.org/u/AllanOricil)\
**Post date:** [19 March 2026 00:51 UTC](https://discourse.nodered.org/t/explicit-permissions-for-node-red-no-more-blind-trust-in-packages/100598/1 "2026-03-19T00:51:40Z")

</div>

All packages built with the NRG framework and CLI (v3 to be announce soon) must declare the permissions they require through a sentinel section in `package.json`. These declared grants define the resources and capabilities the package intends to use at runtime.  
During installation, users are explicitly informed of these requirements and prompted to approve or deny them. Similarly as OAuth apps. This ensures full transparency and gives users control over what a package is allowed to access before it is executed.  
By shifting permission awareness to install time, NRG reduces blind trust in third-party packages and establishes a clear security contract between package authors and users.

```json
{
  "name": "node-red-contrib-xyz",
  "sentinel": {
    "grants": [
      "network:http",
      "network:dns",
      "fs:read:/data",
      "fs:write:/tmp",
      "process:env"
    ]
  }
}

```

Each grant represents a specific capability, allowing for fine-grained control over sensitive operations such as network access, filesystem interaction, and environment inspection.

NRG CLI V3 will soon be released at: [GitHub - AllanOricil/nrg-cli: ⚡️ A powerful CLI tool for generating, building, and managing Node-RED nodes and plugins with best practices. · GitHub](https://github.com/AllanOricil/nrg-cli)

Preview of Framework to author nodes that will be delivered in V3: [GitHub - AllanOricil/node-red-vue-template: Write Node-RED nodes using Vue and Typescript · GitHub](https://github.com/AllanOricil/node-red-vue-template)

NRG Sentinel: [GitHub - AllanOricil/nrg-sentinel-public: Runtime Security layer for Node-RED · GitHub](https://github.com/AllanOricil/nrg-sentinel-public)

---

<div class="post-metadata">

**Author:** ![AllanOricil](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/allanoricil/32/106911_2.png) [@AllanOricil](https://discourse.nodered.org/u/AllanOricil)\
**Post date:** [19 March 2026 01:00 UTC](https://discourse.nodered.org/t/explicit-permissions-for-node-red-no-more-blind-trust-in-packages/100598/2 "2026-03-19T01:00:04Z")

</div>

NRG projects include a Vite plugin that statically analyzes the codebase to determine which permissions (“grants”) a package requires. During the build process, these grants are automatically injected into the sentinel section of the package.json.

When the package is installed, Sentinel’s installer presents these required grants to the user, clearly outlining the capabilities the package needs to function as intended. Users can review and approve these permissions before the package is executed.

Once approved, the grants are persisted in a .sentinel-grants.json file within the Node-RED userDir. This file acts as the authoritative source of truth for package permissions at runtime, and can only be modified by Sentinel upon User approval.

In addition, the same file is used by Sentinel’s side panel, where users can inspect, modify, and manage permissions for installed package nodes. Any changes made through the UI are reflected in this file, ensuring consistency between configuration, enforcement, and visibility.

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [19 March 2026 07:11 UTC](https://discourse.nodered.org/t/explicit-permissions-for-node-red-no-more-blind-trust-in-packages/100598/3 "2026-03-19T07:11:43Z")

</div>

Hi, now that you have released this as a commercial offering, can I suggest that we create a dedicated vendors channel for it ( eg similar to the Flowfuse one) ?

---

<div class="post-metadata">

**Author:** ![AllanOricil](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/allanoricil/32/106911_2.png) [@AllanOricil](https://discourse.nodered.org/u/AllanOricil)\
**Post date:** [19 March 2026 14:00 UTC](https://discourse.nodered.org/t/explicit-permissions-for-node-red-no-more-blind-trust-in-packages/100598/4 "2026-03-19T14:00:14Z")

</div>

yes, why not. But I think it would not help with visibility right now since there isnt organic growth momentum. Maybe when it becomes wide-spread like the other tooling it would be better to have a separate channel.

I had 0 leads since launch. Cant you help with that? I bet you have contacts 👀

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [19 March 2026 14:20 UTC](https://discourse.nodered.org/t/explicit-permissions-for-node-red-no-more-blind-trust-in-packages/100598/5 "2026-03-19T14:20:35Z")

</div>

Hi. I’ll go ahead and get one set up for you. I can’t help with leads as my current employer would not approve, but I think you have plenty of exposure on here with multiple threads both here and on slack.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [17 June 2026 14:20 UTC](https://discourse.nodered.org/t/explicit-permissions-for-node-red-no-more-blind-trust-in-packages/100598/6 "2026-06-17T14:20:48Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.