PaperClipAI/maps/agent-access-map/steering.md

Steering and queued messages — agent access

Product map: Steering and queued messages.

Review date: 2026-10-12. Source commit: 58e16dbddfc9c8d0cf60867f9d9847f0feda055b. Native REST transport reconciled in this change; see the shared transport contract.

This is a source-reviewed baseline of representative operations and known gaps. Each capability needs operation-level review before its entire scope can be qualified. No live agent execution is claimed. Follow the map contract for format, permission checks, evidence and maintenance.

queue

Review: baseline.

API: present — representative operation IDs:

• GET /api/issues/{id}/queued-comments.

Agent access: partial — REST / native call_api for visible queue; server-owned queue admission.

Policy: Queue inspection follows task visibility; queued user-message mutation and run cancellation require a board actor/user.

Evidence: source-only — implementation at the reviewed commit above.

Verification: not-run — exercise a listed permitted operation with actual agent credentials/run context; inspect its result and applicable persistence/attribution. Assert the relevant denied actor, owner, company or mode from Policy. Review the remaining operations before qualifying the whole capability.

Gaps: Agents can read eligible queue state; sending/steering the person's queued messages requires separate authority.

edit-order-discard

Review: baseline.

API: present — representative operation IDs:

• PATCH /api/issues/{id}/queued-comments/{commentId}.
• PUT /api/issues/{id}/queued-comments/order.
• DELETE /api/issues/{id}/queued-comments/{commentId}.

Agent access: restricted — Board-user queue mutation API.

Policy: Queue inspection follows task visibility; queued user-message mutation and run cancellation require a board actor/user.

Evidence: source-only — implementation at the reviewed commit above.

Verification: not-run — assert the documented agent denial with an owned test fixture; verify any listed agent request/result path separately. A delegated operation needs its own policy and access review.

Gaps: No agent user-message edit/reorder/discard path; explicit delegated-user policy needed before granting one.

steer

Review: baseline.

API: present — representative operation IDs:

• POST /api/issues/{id}/queued-comments/{commentId}/steer.

Agent access: restricted — Board-user execution control API; agent receives eligible new run/wake.

Policy: Queue inspection follows task visibility; queued user-message mutation and run cancellation require a board actor/user.

Evidence: source-only — implementation at the reviewed commit above.

Verification: not-run — assert the documented agent denial with an owned test fixture; verify any listed agent request/result path separately. A delegated operation needs its own policy and access review.

Gaps: Steering requires a board user at the HTTP route. Native call_api preserves this denial and cannot impersonate the steering user.

interrupt

Review: baseline.

API: present — representative operation IDs:

• POST /api/issues/{id}/queued-comments/interrupt.
• POST /api/heartbeat-runs/{runId}/cancel.

Agent access: restricted — Board-user interruption/cancel API.

Policy: Queue inspection follows task visibility; queued user-message mutation and run cancellation require a board actor/user.

Evidence: source-only — implementation at the reviewed commit above.

Verification: not-run — assert the documented agent denial with an owned test fixture; verify any listed agent request/result path separately. A delegated operation needs its own policy and access review.

Gaps: Explicit operator action is distinct from an agent yielding/blocking its own turn.

stop-and-pause

Review: baseline.

API: present — representative operation IDs:

• POST /api/issues/{id}/tree-holds.
• POST /api/agents/{id}/pause.

Agent access: restricted — Board control APIs; agent paperclip_finish/paperclip_block for its own turn.

Policy: Queue inspection follows task visibility; queued user-message mutation and run cancellation require a board actor/user.

Evidence: source-only — implementation at the reviewed commit above.

Verification: not-run — assert the documented agent denial with an owned test fixture; verify any listed agent request/result path separately. A delegated operation needs its own policy and access review.

Gaps: Task-tree/agent pause and confirmed stop need policy-preserving authority; no generic agent management path.

drafts

Review: baseline.

API: not-applicable — No shared server draft resource for this presentation state; cross-client drafts would be a deliberate new capability.

Agent access: not-applicable — Browser-local task composer draft / submission state.

Policy: Queue inspection follows task visibility; queued user-message mutation and run cancellation require a board actor/user.

Evidence: source-only — implementation at the reviewed commit above.

Verification: not-run — use the product recipe for the local/developer surface. Verify listed shared-resource reads separately; local presentation alone is not agent API evidence.

Gaps: No shared server draft resource for this presentation state; cross-client drafts would be a deliberate new capability.

approval-queue

Review: baseline.

API: present — representative operation IDs:

• GET /api/issues/{id}/interactions.
• GET /api/issues/{id}/queued-comments.

Agent access: partial — Agent can inspect authorized persisted interactions; server continuation/queue delivery.

Policy: Queue inspection follows task visibility; queued user-message mutation and run cancellation require a board actor/user.

Evidence: source-only — implementation at the reviewed commit above.

Verification: not-run — exercise a listed permitted operation with actual agent credentials/run context; inspect its result and applicable persistence/attribution. Assert the relevant denied actor, owner, company or mode from Policy. Review the remaining operations before qualifying the whole capability.

Gaps: Resolving as a human and controlling queued wakes is separate from seeing the approval response.