PaperClipAI/maps/agent-access-map/documents-artifacts.md

# Documents, attachments, and work products — agent access

Product map: [Documents, attachments, and work
products](../feature-map/documents-artifacts.md).

Feature ID: `documents-artifacts`.

Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.

This is a source-reviewed baseline of representative operations and known gaps.
Each capability needs operation-level review before its entire scope can be
qualified. No live agent execution is claimed. Follow the [map contract](../README.md)
for format, permission checks, evidence and maintenance.

## `documents`

Capability ID: `documents-artifacts/documents`.

Document image selection is browser presentation state. It needs no new API or
agent permission. Agents can share `#document-<key>&image=<one-based-position>`
links with optional `revision` and `viewer=full` parameters. Existing task,
document, revision, and image resource read permissions still apply.

Coordinator receipt reads add `GET /api/issues/{id}/documents/{key}/revisions/{revisionId}`.
It applies the same task-read authorization as document revision history and
queries exactly one revision under that task/document key. It does not fall back
to current content. Cross-task receipts retain both the originating interaction
and document owner; sidebar reads use the owner's existing authorization boundary.
The [document service regression](../../server/src/__tests__/documents-service.test.ts)
checks exact identity and cross-key/task misses against temporary PostgreSQL;
route and live caller authorization remain separately verified.

Review: `baseline`.

API: `present` — representative operation IDs:

- `GET /api/issues/{id}/documents`.
- `PUT /api/issues/{id}/documents/{key}`.
- `POST /api/issues/{id}/documents/{key}/revisions/{revisionId}/restore`.

Agent access: `available` — Native list/read/write documents; other-task bridge; REST /
CLI / MCP.

Policy: Task/resource visibility, mutation/checkout ownership, revision/lock guards and
permitted deliverable context.

Native completion evidence accepts the server's relative link only for a document
attached to the current company/task with a matching current-revision publication
receipt. It can accompany a separately verified requested file; it cannot replace
that file. The [native feedback regression](../../server/src/services/native-runtime/native-completion-feedback.test.ts)
exercises the native write/register/finish boundary with local PostgreSQL and a
controlled remote file reader. It does not qualify the whole document API or a
live provider run.

Evidence: `source-only` — [implementation](../../server/src/routes/issues.ts#L10299) at
the reviewed commit above.

Verification: `not-run` — exercise a listed permitted operation with actual agent
credentials/run context; inspect its result and applicable persistence/attribution.
Assert the relevant denied actor, owner, company or mode from Policy. Review the
remaining operations before qualifying the whole capability.

Gaps: Supported. Native helpers focus on the active task; generic API or explicit
other-task tools cover additional scope.

## `annotations`

Capability ID: `documents-artifacts/annotations`.

Review: `baseline`.

API: `present` — representative operation IDs:

- `POST /api/issues/{id}/documents/{key}/annotations`.
- `PATCH /api/issues/{id}/documents/{key}/annotations/{threadId}`.

Agent access: `available` — REST / native call_api.

Policy: Task/resource visibility, mutation/checkout ownership, revision/lock guards and
permitted deliverable context.

Evidence: `source-only` — [implementation](../../server/src/routes/issues.ts#L10299) at
the reviewed commit above.

Verification: `not-run` — exercise a listed permitted operation with actual agent
credentials/run context; inspect its result and applicable persistence/attribution.
Assert the relevant denied actor, owner, company or mode from Policy. Review the
remaining operations before qualifying the whole capability.

Gaps: Annotation operations exist without a special annotation tool; check revision
anchors and resolver authority.

## `attachments`

Capability ID: `documents-artifacts/attachments`.

Review: `baseline`.

API: `present` — representative operation IDs:

- `POST /api/companies/{companyId}/issues/{issueId}/attachments`.
- `GET /api/assets/{assetId}/content`.

Agent access: `available` — Native register_deliverable and API multipart/binary
support; REST / CLI / MCP transfers.

Policy: Task/resource visibility, mutation/checkout ownership, revision/lock guards and
permitted deliverable context.

Evidence: `source-only` — [implementation](../../server/src/routes/issues.ts#L10299) at
the reviewed commit above.

Verification: `not-run` — exercise a listed permitted operation with actual agent
credentials/run context; inspect its result and applicable persistence/attribution.
Assert the relevant denied actor, owner, company or mode from Policy. Review the
remaining operations before qualifying the whole capability.

Queue and HTTP/2 sandbox callbacks admit `GET /api/assets/{assetId}/content`,
including screenshot references in task descriptions. The controller still checks
company and task visibility before opening storage.

Gaps: Native API uploads are bounded; attachment reading has target/provider and
permission conditions.

## `work-products`

Capability ID: `documents-artifacts/work-products`.

Review: `baseline`.

API: `present` — representative operation IDs:

- `POST /api/issues/{id}/work-products`.
- `PATCH /api/work-products/{id}`.

Agent access: `available` — Native register_deliverable for file outputs; REST / native
call_api for metadata.

Policy: Task/resource visibility, mutation/checkout ownership, revision/lock guards and
permitted deliverable context.

Evidence: `source-only` — [implementation](../../server/src/routes/issues.ts#L10299) at
the reviewed commit above.

Verification: `not-run` — exercise a listed permitted operation with actual agent
credentials/run context; inspect its result and applicable persistence/attribution.
Assert the relevant denied actor, owner, company or mode from Policy. Review the
remaining operations before qualifying the whole capability.

Gaps: A registered reference does not prove uploaded bytes, external delivery, or
accepted review.

## `library`

Capability ID: `documents-artifacts/library`.

Review: `baseline`.

API: `present` — representative operation IDs:

- `GET /api/companies/{companyId}/artifacts`.

Agent access: `available` — REST / native call_api.

Policy: Task/resource visibility, mutation/checkout ownership, revision/lock guards and
permitted deliverable context.

Evidence: `source-only` — [implementation](../../server/src/routes/issues.ts#L10299) at
the reviewed commit above.

Verification: `not-run` — exercise a listed permitted operation with actual agent
credentials/run context; inspect its result and applicable persistence/attribution.
Assert the relevant denied actor, owner, company or mode from Policy. Review the
remaining operations before qualifying the whole capability.

Gaps: Library search/filter uses the artifact API; no new tool needed merely to mirror
the UI.