From 6f2a14d2d7913288e561460cadf52cfb328ada0d Mon Sep 17 00:00:00 2001 From: Dotta Date: Mon, 26 Oct 2026 12:07:29 -0500 Subject: [PATCH] Place scoped account evidence on the listing operation Co-Authored-By: Paperclip --- maps/agent-access-map/runs-adapters.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/maps/agent-access-map/runs-adapters.md b/maps/agent-access-map/runs-adapters.md index d577ed56fb8..9807b976d92 100644 --- a/maps/agent-access-map/runs-adapters.md +++ b/maps/agent-access-map/runs-adapters.md @@ -375,7 +375,7 @@ Gaps: This individual operation has source review but no recorded HTTP verificat API: `present` — `POST /api/companies/{companyId}/ai-connection-pools`; JSON REST. Agent access: `available` — agent REST and default native `search_api` / `call_api`. Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user. -Evidence: `verified` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware, including account/pool filtering by agent connection scope with both persistent keys and run JWTs. Pool visibility checks every member account. +Evidence: `verified` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware. Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification. Gaps: Provider fixtures do not qualify live provider setup or availability. @@ -429,7 +429,7 @@ Gaps: Agent invocation is denied by the stated policy. The authorized human or o API: `present` — `GET /api/companies/{companyId}/ai-connections`; JSON REST. Agent access: `available` — agent REST and default native `search_api` / `call_api`. Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user. -Evidence: `verified` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware. +Evidence: `verified` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware, including account/pool filtering by agent connection scope with both persistent keys and run JWTs. Pool visibility checks every member account. Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification. Gaps: Provider fixtures do not qualify live provider setup or availability.