I cannot read a protected file

TVO-PERM-001 is a policy-protected read denial (exit class 13). The error names the required attributes, the attributes your identity actually holds, and the difference between them — read it before doing anything else. It is designed so the gap is self-evident.

The diagnostic

tovio access check <path>tovio policy show <path>tovio policy test <path> --identity <identity.pub>

--identity takes the recipient’s identity.pub file; omit it to test your own identity. access check and policy test also take --write, to ask about the write policy instead of the read policy — policy show does not, because it prints the whole policy for the path either way.

The four usual causes

1. Never enrolled. Check tovio access list. Fix: someone grants you access.
2. Missing an attribute the policy tests for. The error names it. Fix: tovio access request <pattern> --attr <name>=<value> — the flag is repeatable, and takes a path pattern, not a single file.
3. Expired attribute certificate. That surfaces as TVO-KEY-001, not PERM. Check tovio key status. In a self-KA (team) repository tovio key renew re-issues it and you are done; against a remote Key Authority, renewing your own certificate is not yet a local command — ask whoever runs the KA. This one looks like lost access and is often the whole problem.
4. No secret clearance. You have path access but the content is clearance-gated. Clearance is a separate attribute, granted explicitly.

Denied on write rather than read

A write refused by the path’s write policy is TVO-PERM-002, not 001. Same diagnosis, but run the checks with --write.

If you are an agent or using a token

tovio agent show <token-id>

Check the token’s scope and clearance. A path outside the token’s scope is rejected as TVO-TOKEN-001 before any policy is read — so a TOKEN code means look at the token, and a PERM code means look at the policy. They are never the same problem.

Reporting it

Give the code and which of the four you ruled out. Not the path, not the policy, not the attribute names, and not the --json context block — it carries all of them.