Ask for access you do not have

tovio access request <pattern>tovio access request <pattern> --writetovio access request 'config/production/**' --attr clearance=secrets

Opens a portable access request for a path or glob, rather than messaging someone and hoping. --attr is repeatable and names the attribute you believe you are missing; the TVO-PERM-001 error you just hit prints the exact line to run.

Requesting on someone else's behalf

tovio access request <pattern> --from ./their.identity.pub

Defaults to this repository's identity. Use --from when you are filing on behalf of another identity.

What a request is, precisely

It is a record, not an entitlement. The request carries your identity and what you are asking for so an approver can act on it directly, but it is deliberately non-authoritative: it can ask for attributes, and only tovio access grant can issue signed claims. Submitting the same request twice is idempotent.

For the approver

tovio access requeststovio access grant --identity ./their.identity.pub --attr clearance=secrets

Remember the grant is prospective — tell the requester they may need the path committed again before they can read it.

Ask for the attribute, not the path

Requesting clearance=secrets is usually better than requesting a path list: it matches how policies are written, so it keeps working as paths change.

Check what you need first

tovio policy show <path>tovio access check <path>

Knowing which predicate you fail makes the request specific, and specific requests get approved faster.