iCloud Drive

Read and organise files in iCloud Drive, on the Mac that syncs them.

Connect it

$ lanes link connect icloud_drive --profile personal --workspace local

There is nothing to authenticate to. It reads a folder that is already on your machine, so the files are reachable the moment the connection exists.

What your agent can do

A folder is a folder, so the capabilities are fixed:

• icloud_drive.list_files
• icloud_drive.read_file
• icloud_drive.search_files
• icloud_drive.file_info
• icloud_drive.write_file
• icloud_drive.move_file
• icloud_drive.create_folder
• icloud_drive.trash_file

What is recorded

Every call is recorded, allowed or refused. The rule is to keep the shape and withhold the words: an audit log that reproduced the content would be a second copy of the thing it was meant to make accountable.

Identifiers such as path, recursive, limit, overwrite, from, and to are kept. Everything that carries your words is withheld.

What an entry holds and how to read one is on the audit log.

Narrowing what it may do

Connecting grants the read bundle. Tightening it happens on your machine and takes effect at once:

$ lanes link policy deny 'icloud_drive.*' --connection icloud_drive.main --profile personal --workspace local

A deny always beats an allow, whatever the order in the file. See Scopes and permissions for widening, and for what can and cannot be set per connection.

Next: every provider, or Connections for what a connection is and the methods behind one.