```{index} single: permit_only (Opcode) ``` ```{index} single: Opcode::permit_only ``` ```{index} single: Opcode::permit ``` ```{index} single: Opcode::deny_only ``` ```{index} single: Opcode::deny ``` # permit_only `Opcode::permit_only($safe, @ops)`, `Opcode::permit($safe, @ops)`, `Opcode::deny_only($safe, @ops)`, `Opcode::deny($safe, @ops)`: change the operator mask of a compartment object - any blessed hash, such as a `Safe`, whose `Mask` entry is an opset (created when missing). The operators are given as names, `:tag`s and opsets; a name with a leading `!` counts inverted. Also available as `Opcode::permit`, `Opcode::deny_only`, `Opcode::deny`. - `permit` allows the named operators, `deny` forbids them, both on top of the current mask; - `permit_only` allows the named operators and forbids every other; `deny_only` forbids the named ones and allows every other. ```perl my $c = Safe->new; Opcode::permit_only($c, ':default'); Opcode::deny($c, 'print'); $c->reval('print "x"'); # 'print' trapped by operation mask ``` `Safe`'s methods of the same names are its own Perl code over `opset`; these are the older XS versions. Anything but a blessed hash dies "Not a Safe object".