DottaandClaude Opus 5.5
353945c86d
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - Tool gateways let external MCP clients use a company's tools with a
gateway client token
> - Since delegated connection management (#17737), an agent can create
and revoke gateway client tokens for its responsible person
> - #20581 stopped agents from getting the one-time token value, but it
did this by making token creation person-only
> - The product decision is that agents keep their delegated authority
to create and revoke tokens
> - This pull request restores agent token creation, but the agent never
receives the token value: the person reveals the value once on the
gateway's Tokens page
> - The benefit is that an agent can do the rotation work for the
person, and the secret still never enters chat, run events, logs or tool
output
## Linked Issues or Issue Description
Refs #17737
Refs #20581
**What happened**
After #20581, `POST /api/tool-gateway/gateways/{gatewayId}/tokens`
returns 403 `gateway_token_requires_person` to every agent caller.
Agents lost the delegated authority to create gateway client tokens that
#17737 gave them. Before #20581, an agent that created a token received
the plaintext value in its tool result and could repeat it in chat.
**Expected behavior**
An agent with delegated connection management can create and revoke
gateway client tokens. The agent never receives a token value. The
responsible person gets the value once, on the gateway's Tokens page.
Person callers keep today's behavior.
**Steps to reproduce**
1. Give an agent delegated connection management for a responsible
person with `tools:admin`.
2. As the agent, call `POST
/api/tool-gateway/gateways/{gatewayId}/tokens` (for example through
`call_api`).
3. See 403 `gateway_token_requires_person`.
## What Changed
- Agent create: `POST /api/tool-gateway/gateways/:gatewayId/tokens` from
an agent with delegated authority returns 201 with token metadata only
(`id`, `tokenPrefix`, `expiresAt`, `pendingReveal: true`), plus
`tokensPath`, a `reveal_credential` `requiredUserAction` for the
responsible person, and a `nextStep` instruction. The saved row has no
usable value: its stored hash is of a value that is generated and then
discarded. Gateway authentication also rejects `pendingReveal` rows.
- Person reveal: new person-only `POST
/api/tool-gateway/gateway-tokens/:tokenId/reveal`. It generates the
value, stores its hash, clears `pendingReveal` and returns the value
once. A conditional update makes a second or concurrent reveal return
409. Only the token's responsible person can reveal it (403
`gateway_token_reveal_requires_responsible_person`). Agent callers get
403 `gateway_token_requires_person`. A token revoked before reveal
cannot be revealed.
- Why a reveal that generates the value: no stored plaintext existed to
reveal, and storing one (even encrypted) for later display adds a secret
at rest. Generating the value at reveal time keeps the existing one-time
display and stores only a hash.
- Schema: `tool_mcp_gateway_tokens.pending_reveal boolean not null
default false` (migration `0460_gateway_token_pending_reveal`). Shared
`ToolMcpGatewayToken.pendingReveal`, and `ConnectionRequiredUserAction`
gets `reveal_credential` / `gateway_token`.
- UI: the Tokens page shows a "Waiting for you to reveal" section for
pending tokens with a "Reveal token" button. The value appears in the
existing "New token — copy now" one-time block. Pending tokens show the
status "Not revealed".
- Agent gateway create: the 201 for agent callers also includes
`gatewayPath`, `tokensPath` and a `nextStep` that tells the agent to
link the saved gateway.
- The agent create-token `nextStep` and the catalog say not to revoke
the old token in the same turn: its client keeps working on it until the
person installs the new value.
- The reveal update and its `tool_gateway.token_revealed` activity entry
commit in one transaction. The Tokens page offers Reveal only for tokens
that act for the signed-in person.
- API reference: new `docs/api/tool-gateway-tokens.md` (create, reveal,
revoke) in the docs nav.
- Revoke stays allowed for agents with delegated authority (unchanged
route).
- API catalog: create-gateway, create-token, reveal and revoke
descriptions now say who acts, that agents never receive values, the
page paths, and that the old token is revoked only after the client
works with the new one.
- Agent access map: create-token policy note and a new reveal entry.
- Evals `gateways-profiles.create-gateway` and
`gateways-profiles.rotate-token`:
- Remove the keyword grader (`human|operator|admin|manage`) and the
handoff text checks. Grade saved state, rendered links and secret
absence. A plain reply or a question card is accepted.
- Remove the setup probes that called the create routes as the agent.
Under delegated authority, those probes created a real gateway
("Forbidden agent gateway"), which failed create-gateway before the
agent ran.
- create-gateway: exactly one gateway for the intended profile and
company, created by the agent (or by the person after a handoff); the
person opens it from a rendered link; attribution matches the creator;
any agent-created token is still pending reveal; no token value in chat,
cards or run events.
- rotate-token: after the agent's turn, both setup tokens still work and
any replacement the agent created is pending the person's reveal; the
person follows the rendered Tokens page link and reveals (or issues) the
value in a private browser; the new value works before the old token is
revoked; the unrelated client keeps access; no token value appears
anywhere, including a regex scan for any full `pcgw_<id>.<secret>`
value.
- The changed scenario context and outcomes are recorded in
`chat-full-catalog-testops-manifest.json` `changedFields` and pinned in
the manifest test. The inventory digest, descriptors (`oracleVersion`
v2, `sourceFiles`) and SDK public input pins are updated. The unused
`external-gateway-handoff.ts` module is removed.
- Fixture realism: the create-gateway profile now allows a real read
tool (an empty profile made the agent ask which apps to add instead of
finishing), and the rotation tokens get a neutral owner note instead of
"Disposable rotation fixture" (the agent read that note as an eval
hint).
- Shared private-browser helpers (`external-private-browser.ts`,
`external-private-browser-worker.ts`) get one optional `pendingTokenId`
input and one `revealedPending` receipt field.
## Verification
- Red: on `master` route code, the new integration tests `lets agents
create and revoke gateway client tokens without ever receiving a token
value` and `reveals an agent-created gateway token value only to its
responsible person` fail (403 `gateway_token_requires_person`).
- Green: `cd server && npx vitest run
src/__tests__/connection-management.integration.test.ts -t gateway` (25
passed). The test checks that the agent `call_api` result has no `token`
field and no token-shaped value, that the agent cannot reveal, that the
person reveals once (second reveal 409) and the value authenticates,
that agent revoke works and stops the value, that a token revoked before
reveal never gets a value, and that person create still returns the
value.
- `npx vitest run src/__tests__/tool-gateway.test.ts
src/__tests__/openapi-routes.test.ts
src/services/native-runtime/runner-api.test.ts` (2247 passed).
- `cd ui && npx vitest run
src/pages/apps/gateways/panels/TokensPanel.test.tsx
src/pages/apps/gateways/gateway-helpers.test.ts` (16 passed); `pnpm
check:token-gates` clean.
- Eval graders and catalog: `pnpm exec vitest run --config
tests/runner-e2e/vitest.config.ts` on the gateway oracle tests,
`external.test.ts`, catalog consistency/contract, TestOps
export/retained, phase/clock callers and SDK input/type tests (all
pass); `node --test` on the TestOps manifest, adapter, contract,
streaming and reconcile tests (all pass); `node
tests/runner-e2e/source-sdk-public-inputs.mjs <HEAD> --check`
(unchanged).
- `node scripts/check-maps.mjs` passes. `tsc --noEmit` for `server`,
`ui` and `tests/runner-e2e`: no errors in changed files.
- Paid end-to-end run of both eval cases, run
[42872921890](https://github.com/paperclipai/paperclip/actions/runs/42872921890)
on 39f38a7f6c (before the last three commits): both FAILED, for
agent-behavior reasons the later commits address. Not rerun yet.
- rotate-token: the agent created the replacement (pending reveal, no
value), then revoked the old token in the same turn, despite the create
response saying to wait. Its reasoning cited the eval-looking fixture
note. The grader rejected the premature revocation. The reply linked the
Tokens page correctly.
- create-gateway: the agent created the gateway and one pending token,
then asked a question card about which apps to add to the empty profile,
with no link to the gateway. The grader rejected the missing link.
- Token values: a scan of all evidence files of both cells found no full
`pcgw_<id>.<secret>` value and no `pcgw_<uuid>` form. Agent `call_api`
payloads in run events are redacted; the integration test proves the
agent tool result has no value.
## Risks
- Behavior change for agents: token create returns metadata and a Tokens
page path, not a value. Agents that expect `token` in the response must
send the person to the Tokens page.
- Migration adds one boolean column with a default. Existing tokens get
`false` and keep working.
- A pending token that is never revealed stays as an unusable row until
someone revokes it. It cannot authenticate.
## Model Used
- Anthropic Claude Opus 5.5 (`claude-opus-5-5`), tool use and code
execution in Claude Code.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
37 KiB
Tool gateways and access profiles — agent access
Product map: gateways-profiles.
Feature ID: gateways-profiles.
Delegated native entries inherit the native admission and work-mode limits.
Review date: 2026-10-26. Source base: a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb; implementation: #17737.
Connection operations reviewed in this working tree. The inventory was reconciled against production UI clients, REST registrations and service entry points; it is a review checklist, not a runtime registry. Authorization and evidence contract. Fixture evidence is separate from live provider qualification and from empirical LLM success. Source-only entries have a reviewed agent path or an explicit boundary, but do not claim an individually executed HTTP test.
gateway
Capability ID: gateways-profiles/gateway.
Review: operation-reviewed.
get-companies-tools-gateways
API: present — GET /api/companies/{companyId}/tools/gateways; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections (responsible user: tools:admin); shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; authenticated fixtures inspect the saved gateway after a denied binding change.
Verification: passed — local assembled server and real database; gateway visibility and unchanged target assignment after profile-grant revocation. No live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-companies-tools-gateways
API: present — POST /api/companies/{companyId}/tools/gateways; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections (responsible user: tools:admin); bindings also require tools:manage_profiles. Shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
patch-tool-gateway-gateways
API: present — PATCH /api/tool-gateway/gateways/{gatewayId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections (responsible user: tools:admin); setting or clearing bindings also requires tools:manage_profiles. Shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; authenticated fixtures exercise persisted binding changes and revoked/scoped authority.
Verification: passed — local assembled server and real database. Clearing a binding requires retained profile authority; replacement profile/project changes require access to both saved and replacement resources. Authorized changes persist. No live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
profiles
Capability ID: gateways-profiles/profiles.
Review: operation-reviewed.
get-companies-tools-profiles
API: present — GET /api/companies/{companyId}/tools/profiles; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — authenticated fixtures exercise saved application/catalog/tool-name/risk selectors, allow-all profiles, managed empty profiles, personal-account visibility, and scoped grants through actual keys and run JWTs.
Verification: passed — local assembled server and real database; inaccessible profile resources are omitted from lists and denied before new-tool or effective-profile data is returned. Proposed broad entries and installed connections use the same authority checks.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-companies-tools-profiles
API: present — POST /api/companies/{companyId}/tools/profiles; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; mutations whose entry selectors resolve connections also require tools:manage_connections. shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
get-companies-tools-profiles-effective-agents
API: present — GET /api/companies/{companyId}/tools/profiles/effective/agents/{agentId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — authenticated fixtures exercise saved application/catalog/tool-name/risk selectors, allow-all profiles, managed empty profiles, personal-account visibility, and scoped grants through actual keys and run JWTs.
Verification: passed — local assembled server and real database; inaccessible profile resources are omitted from lists and denied before new-tool or effective-profile data is returned. Proposed broad entries and installed connections use the same authority checks.
Gaps: Provider fixtures do not qualify live provider setup or availability.
patch-tool-profiles
API: present — PATCH /api/tool-profiles/{profileId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; mutations whose entry selectors resolve connections also require tools:manage_connections. shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-profiles-duplicate
API: present — POST /api/tool-profiles/{profileId}/duplicate; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; mutations whose entry selectors resolve connections also require tools:manage_connections. shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
delete-tool-profiles
API: present — DELETE /api/tool-profiles/{profileId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; mutations whose entry selectors resolve connections also require tools:manage_connections. shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-profiles-entries
API: present — POST /api/tool-profiles/{profileId}/entries; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; mutations whose entry selectors resolve connections also require tools:manage_connections. shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
patch-tool-profile-entries
API: present — PATCH /api/tool-profile-entries/{entryId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; mutations whose entry selectors resolve connections also require tools:manage_connections. shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
delete-tool-profile-entries
API: present — DELETE /api/tool-profile-entries/{entryId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; mutations whose entry selectors resolve connections also require tools:manage_connections. shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-tools-profiles-bind
API: present — POST /api/companies/{companyId}/tools/profiles/{profileId}/bind; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; mutations whose entry selectors resolve connections also require tools:manage_connections. shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user. Resolve issue/routine/gateway targets, private parent/project access, and affected agents. Existing bindings and saved gateway profile references retain the same checks.
Evidence: verified — production-authenticated integration fixture with real database persistence and deterministic provider responses where required.
Verification: passed — Actual authenticated requests bind/unbind an authorized task and reject issue/routine/gateway targets outside agent configuration scope. Existing bindings and gateway profile references are rechecked on profile edits.
Gaps: Fixture evidence does not qualify live provider behavior or an empirical model success rate.
post-companies-tools-profiles-unbind
API: present — POST /api/companies/{companyId}/tools/profiles/{profileId}/unbind; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; mutations whose entry selectors resolve connections also require tools:manage_connections. shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user. Resolve issue/routine/gateway targets, private parent/project access, and affected agents. Existing bindings and saved gateway profile references retain the same checks.
Evidence: verified — production-authenticated integration fixture with real database persistence and deterministic provider responses where required.
Verification: passed — Actual authenticated requests bind/unbind an authorized task and reject issue/routine/gateway targets outside agent configuration scope. Existing bindings and gateway profile references are rechecked on profile edits.
Gaps: Fixture evidence does not qualify live provider behavior or an empirical model success rate.
client-connect
Capability ID: gateways-profiles/client-connect.
Review: operation-reviewed.
get-mcp-gateways
API: present — GET /mcp/gateways/{gatewayPublicId}; browser/provider/MCP protocol.
Agent access: restricted — GET always returns HTTP 405 with Allow: POST. Use the corresponding POST MCP operation.
Policy: GET streaming is unsupported; this is a transport boundary independent of principal permissions. POST still requires the documented MCP authentication and resource policy.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — source-reviewed fixed 405 handler. A protocol check should assert status 405 and Allow: POST; use POST to exercise authenticated MCP calls.
Gaps: No GET event stream is implemented. This entry does not advertise a usable GET client connection.
post-mcp-gateways
API: present — POST /mcp/gateways/{gatewayPublicId}; browser/provider/MCP protocol.
Agent access: available — existing authenticated MCP/provider protocol; not callable as JSON REST.
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority. Issuer and target Block/Ask first/rate decisions intersect using the existing evaluator; credentials must select the same identity. Human continuation rechecks current token actions, scope, grants and both policies. Approval attribution records the issuer independently of the target; deleted tokens fail closed. Board clients and run-bound heartbeat clients retain their separate behavior.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — local assembled server and actual gateway-token authentication. Durable clients survive setup-run completion, honor purpose scopes, and reject revoked user/issuer authority and a cleared issuer foreign key. Thirteen actual-auth cases additionally verify issuer/target Block, governed approval, current policy/grant/token revocation and deletion, narrowed actions, independent/shared rates, credential identity and board-issued approval compatibility. No live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
get-tool-gateway-gateways-mcp
API: present — GET /api/tool-gateway/gateways/{gatewayId}/mcp; browser/provider/MCP protocol.
Agent access: restricted — GET always returns HTTP 405 with Allow: POST. Use the corresponding POST MCP operation.
Policy: GET streaming is unsupported; this is a transport boundary independent of principal permissions. POST still requires the documented MCP authentication and resource policy.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — source-reviewed fixed 405 handler. A protocol check should assert status 405 and Allow: POST; use POST to exercise authenticated MCP calls.
Gaps: No GET event stream is implemented. This entry does not advertise a usable GET client connection.
post-tool-gateway-gateways-mcp
API: present — POST /api/tool-gateway/gateways/{gatewayId}/mcp; browser/provider/MCP protocol.
Agent access: available — existing authenticated MCP/provider protocol; not callable as JSON REST.
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-tool-gateway-tools
API: present — GET /api/tool-gateway/tools; JSON REST.
Agent access: available — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-gateway-tools-call
API: present — POST /api/tool-gateway/tools/call; JSON REST.
Agent access: available — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
tokens
Capability ID: gateways-profiles/tokens.
Review: operation-reviewed.
post-tool-gateway-gateways-tokens
API: present — POST /api/tool-gateway/gateways/{gatewayId}/tokens; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections (responsible user: tools:admin); shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user. Agent callers receive token metadata and the Tokens page path only; the token value is generated when the responsible person reveals it.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-tool-gateway-gateway-tokens-reveal
API: present — POST /api/tool-gateway/gateway-tokens/{tokenId}/reveal; JSON REST.
Agent access: operator-only — person-only; agent callers receive 403 gateway_token_requires_person.
Policy: board session with tools:admin; only the responsible person of an agent-created token can reveal it, once.
Evidence: verified — route; authenticated fixtures cover agent denial, one-time reveal, a working revealed value and responsible-person enforcement.
Verification: passed — local assembled server.
Gaps: No live provider qualification.
post-tool-gateway-gateway-tokens-revoke
API: present — POST /api/tool-gateway/gateway-tokens/{tokenId}/revoke; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections (responsible user: tools:admin); shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-gateway-sessions
API: present — POST /api/tool-gateway/sessions; JSON REST.
Agent access: available — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-gateway-sessions-revoke
API: present — POST /api/tool-gateway/sessions/{sessionId}/revoke; JSON REST.
Agent access: available — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
activity
Capability ID: gateways-profiles/activity.
Review: operation-reviewed.
get-companies-tools-runtime-slots
API: present — GET /api/companies/{companyId}/tools/runtime-slots; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_runtime; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-tools-runtime-slots-stop
API: present — POST /api/companies/{companyId}/tools/runtime-slots/{id}/stop; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_runtime; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-tools-runtime-slots-restart
API: present — POST /api/companies/{companyId}/tools/runtime-slots/{id}/restart; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_runtime; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-companies-tools-runtime-health
API: present — GET /api/companies/{companyId}/tools/runtime-health; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_runtime; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-companies-tools-runs-decisions
API: present — GET /api/companies/{companyId}/tools/runs/{runId}/decisions; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:view_audit; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-tool-gateway-runtime-slots
API: present — GET /api/tool-gateway/runtime-slots; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_runtime; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-gateway-runtime-slots-stop
API: present — POST /api/tool-gateway/runtime-slots/{slotId}/stop; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_runtime; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-gateway-runtime-slots-restart
API: present — POST /api/tool-gateway/runtime-slots/{slotId}/restart; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_runtime; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-tool-gateway-audit
API: present — GET /api/tool-gateway/audit; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:view_audit; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.