Check whether someone can read a path

tovio access check <path>tovio access check <path> --identity ./peer.identity.pubtovio access check <path> --write

Answers whether a recipient satisfies the policy for a path — for reading, or with --write for the path's write policy. It reports per-attribute, so you see which predicate failed rather than just a verdict.

This is the command errors point you at

TOVIO never emits a bare "permission denied". TVO-PERM-001 names the required expression, the attributes your identity holds, the specific attribute you are missing, and this command. When someone reports they cannot read a file, run it with their identity.pub, not yours.

The usual causes

• They were never enrolled — check tovio access list.
• They lack an attribute the condition tests for.
• They were granted after the content was committed, and the path has not been committed since. Grants are prospective.
• Their attribute certificate expired — tovio key status, then TVO-KEY-001.
• Their key material is missing on that machine — TVO-KEY-002. This is a keychain problem, not a policy problem.

The related command

tovio policy test <path> --identity ./peer.identity.pub

Evaluates the expression alone. A disagreement between the two points at enrolment, timing, or key state rather than the policy text.

Before you paste the output anywhere

This command's output names the path, the identity, and the attributes involved. Strip the path, the DID, and the role, team and clearance values before sharing it outside your organisation — together they describe who can reach what. The error code alone is usually enough to get help.