DottaandPaperclip
554a770c6f
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - The Apps Permissions page reads saved access profiles for one connection. > - The page fetched every company profile, rule, and binding. > - It used only the app profile and eligible task-granted profiles for that connection. > - This pull request adds a saved configuration read owned by the profile service. > - The route keeps current connection and per-profile management checks. > - The benefit is fewer database rows, less Node work, and a smaller response for the same displayed configuration. ## Linked Issues or Issue Description **Subsystem affected** Server profile configuration reads and the Apps Permissions and Review data caller. **Problem or motivation** One connection page loaded and serialized unrelated company profiles. In the local fixture, this produced a 32.35 MB response with 76,001 rule rows. **Proposed solution** Select the displayed connection's app profile and exact eligible connection-intent profiles before loading their entries and bindings. Return an explicit configuration DTO with complete selected arrays. Keep summary and pending-review work on the existing full API. **Alternatives considered** Filtering the full response in the browser retains the database and Node cost. Truncating the full API would break other clients. Filtering entries to the connection would lose selectors and bindings needed by saves. **Roadmap alignment** This improves the existing governed Apps capability. It does not add a new access policy. Related merged work: #18673 and #18681. Related harness cleanup: #18683. Public PR searches found no duplicate connection configuration projection. ## What Changed - Add `ToolProfileConfiguration` and `GET /api/tool-connections/{connectionId}/profile-configuration`. - Select `app:<connectionId>` at any status and exact active, correctly bound `connection_intent` profiles. Run the existing per-profile visibility filter before configuration queries. - Preserve complete ordered entries and bindings. Keep all save behavior, empty-binding install fallback, and the existing full profile API. - Switch AppDetail and AgentConnectionAccess to the configuration DTO. Use a distinct cache key below the existing profiles prefix so mutation and reconnect invalidations still refresh it. - Add real PostgreSQL differential and authenticated HTTP tests, UI caller coverage, a reproducible benchmark, and access-map documentation. ## Verification Baseline: `3f8ebfff8aa9febd0733c6f65b07485dcadfd0e2`, after both #18673 and #18681. Final head: `b40c1ed7c0833d403e20ee8a5ff9d09f1bad6d22`. Current implementation and reproduction details are in [the performance note](https://github.com/paperclipai/paperclip/blob/b40c1ed7c0833d403e20ee8a5ff9d09f1bad6d22/doc/performance/2026-11-02-connection-profile-configuration.md). - AppDetail: 79 tests passed. Existing access/action saves, install fallback, grant removal, errors, and refresh cases use the new caller. - Real PostgreSQL differential: passed. Full ordered selected configuration equals the old full-list selection. Cases cover extra bindings, sibling selectors, wrong source/key/status/binding, null and non-string agent metadata, fresh mutations, empty app bindings, visibility filtering, and company scope. - Production HTTP authentication: API key and run JWT cases passed. Hidden personal accounts omit spanning profiles. Private connection reads fail. Restored ownership restores visibility. Revoked management grants deny fresh calls. Final UID canonicalization and foreign-company 404 assertions passed on the current head. - Map structural check, token gate, and `git diff --check`: passed. - Required local `pnpm -r typecheck` and `pnpm build`: passed on the current head. `pnpm test:run` was started once. Its first chat shard passed (337 tests, 151.87 seconds); the second shard was intentionally interrupted after the complete final-head CI suite passed. This partial local attempt is not a full local test pass. The same stable-runner general and serialized partitions and Runner lanes passed in [final-head CI](https://github.com/paperclipai/paperclip/actions/runs/41538805231), including aggregate `ci / verify`. No local assertion failures were observed before interruption. - Final-head focused acceptance: four files, 85 tests passed. Full token gates, maps, and module boundaries passed. - Actual browser acceptance passed on the current checkout with isolated real PostgreSQL and a local trusted board. An action saved as Off persisted after reload. Both app agent bindings stayed intact. Removing an agent-only task grant persisted after reload. Requests used only the narrow profile endpoint. No browser exceptions occurred. No responses were mocked. No provider calls or hosted changes were made. The helper stopped the owned runtime and database after the check. - Final exact-head checks: 54 success, one clean neutral Paperclip Review, three skipped, zero pending or failures. Legacy Snyk status: success. No inline review comments. - Greptile reviewed exact head `b40c1ed7c0833d403e20ee8a5ff9d09f1bad6d22`: 5/5, no findings, completed successful check. Five alternating unprofiled pairs ran with real PostgreSQL on macOS/arm64, Node v24.22.2, and forced GC. The fixture has 210 profiles (200 heavy profiles plus ten eligibility cases), 76,001 rules, 1,900 active tools, 695 removed tools, and 12 agents. The selected configuration has two profiles and 1,391 rules. Each pair asserts complete ordered selected DTO equality. | Measurement | Full list | Configuration read | | --- | --- | --- | | Service wall ms, median [min, max] | 200.927 [193.319, 213.390] | 6.414 [5.508, 6.973] | | Node CPU ms, median [min, max] | 262.751 [246.727, 271.573] | 27.525 [22.576, 29.308] | | Select queries / returned rows | 7 / 78,139 | 3 / 1,397 | | Actual response JSON bytes | 32,353,534 | 592,233 | | Serialization wall ms, median [min, max] | 90.714 [88.715, 99.304] | 1.644 [1.637, 1.745] | | Serialization CPU ms, median [min, max] | 90.644 [88.569, 96.778] | 1.654 [1.637, 1.807] | Reproduce: `node --expose-gc --import ./server/node_modules/tsx/dist/loader.mjs server/scripts/benchmark-connection-profile-configuration.ts 5`. The benchmark measures the service and actual response JSON separately. It excludes HTTP and authorization work through an identity visibility callback. Node CPU does not include PostgreSQL CPU. No hosted or foreground-under-load improvement is claimed. Preserved failures: offline install lacked a locked tarball; frozen online install passed. Sandbox localhost and tsx IPC restrictions blocked initial DB/typecheck attempts; permitted retries use the same checks. The first HTTP suite needed the unbuilt plugin SDK; its owning build helper fixed setup. Shared typecheck caught a missing barrel export, now fixed. A broad typecheck inherited the host's unpinned nested pnpm executable; the owned stalled process was stopped and restarted with pinned pnpm 9. The complete current-head CI suite and aggregate verify passed. The separate Paperclip agent review published 5/5 with no findings at this head and completed with a clean neutral conclusion. An added foreign-company assertion expected 403; the existing guard correctly returned 404. Only the test expectation changed. The first real browser attempt saved and reloaded the action correctly, but grant deletion returned 422: the stress fixture had a company binding, which makes that profile the company default. The UI showed the existing deletion error. The second browser seed used the production agent-only intent shape and passed removal and reload. This does not change the stress fixture or product deletion gates. Initial external browser script attempts also needed an ESM extension and the correct dependency path. Logs, first-failure screenshots, traces, and result files are retained in the local evidence directory. ## Risks - SQL selection must stay aligned with connection-intent eligibility. Differential fixtures cover the exact current predicate. - A selected connection can still have many rules. This change preserves all selected configuration. - Per-profile authorization still reads current selected resources and can add work. Connection visibility does not bypass that check. - No migration, default-allow, effective-access, policy-review, provider, or deployment behavior changes. The old endpoint remains available. Rollback restores the old AppDetail caller and removes the additive endpoint. ## Model Used OpenAI Codex, `gpt-6.1-sol`, with code execution and repository tools. The host does not expose the context-window size. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
57 KiB
App access, action permissions, and testing — agent access
Product map: app-permissions.
Feature ID: app-permissions.
Delegated native entries inherit the native admission and work-mode limits. Explicitly requested policy administration may target the acting agent when its management grants, resolved resources and responsible-user authority permit it. A denied tool call does not authorize silently relaxing policy. Governed-action self-approval and editing one's own principal permissions remain prohibited; see shared guidance.
Review date: 2026-10-26. Source base: a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb; implementation: #17737.
Connection operations reviewed in this working tree. The inventory was reconciled against production UI clients, REST registrations and service entry points; it is a review checklist, not a runtime registry. Authorization and evidence contract. Fixture evidence is separate from live provider qualification and from empirical LLM success. Source-only entries have a reviewed agent path or an explicit boundary, but do not claim an individually executed HTTP test.
agent-access
Capability ID: app-permissions/agent-access.
Review: operation-reviewed.
get-tool-connections-grants
API: present — GET /api/tool-connections/{connectionId}/grants; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user. Human capability descriptions
reuse retained-target checks within one request for direct tool and AI connections.
Pools with referenced accounts and delegated actors retain the full evaluator;
mutations always reauthorize.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
put-tool-connections-grants-members
API: present — PUT /api/tool-connections/{connectionId}/grants/{grantId}/members; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles and tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-connections-grants-installations
API: present — POST /api/tool-connections/{connectionId}/grants/installations; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles and tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
delete-tool-connections-grants
API: present — DELETE /api/tool-connections/{connectionId}/grants/{grantId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-connections-grants-delegations
API: present — POST /api/tool-connections/{connectionId}/grants/{grantId}/delegations; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles and tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — authenticated integration fixtures passed through production authentication and database persistence.
Verification: passed — deterministic local fixture; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
delete-tool-connections-grants-delegations
API: present — DELETE /api/tool-connections/{connectionId}/grants/{grantId}/delegations/{delegationId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles and tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — authenticated integration fixtures passed through production authentication and database persistence.
Verification: passed — deterministic local fixture; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
get-tool-connections-profile-configuration
API: present — GET /api/tool-connections/{connectionId}/profile-configuration; JSON REST. Returns saved app and eligible connection-intent profiles, including complete ordered entries and bindings. Omits summary and pending-review counts. The company-wide full profile list stays available.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; the displayed connection and every selected profile use current management-resource authorization. Profiles that span a hidden personal account are omitted. Connection visibility alone does not grant profile visibility.
Evidence: verified — authenticated integration fixture covers standard agent keys and run JWTs, private accounts, missing resources, and revoked authority on local PostgreSQL.
Verification: passed — deterministic local fixture. Configuration differential test compares complete selected entries and bindings with the full list, including mutations and empty bindings.
Gaps: These fixtures do not qualify live providers or hosted performance.
get-tool-connections-installs
API: present — GET /api/tool-connections/{connectionId}/installs; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
put-tool-connections-installs
API: present — PUT /api/tool-connections/{connectionId}/installs; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles and tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Only new installation targets receive the app-profile binding. Existing targets
retain their saved profile assignments, including deliberately removed grants.
Non-empty saves still remove legacy connection-wide include entries from the
managed app profile when no new targets are added.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual agent-authenticated operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Installation permission regressions exercise operator HTTP requests, persisted assignments, tool-policy decisions, and access-extension audit records with PostgreSQL. Those fixtures do not qualify agent authentication. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
action-policy
Capability ID: app-permissions/action-policy.
Review: operation-reviewed.
get-companies-tools-trust-rules
API: present — GET /api/companies/{companyId}/tools/trust-rules; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-companies-tools-policies
API: present — GET /api/companies/{companyId}/tools/policies; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-tools-policies-reorder
API: present — POST /api/companies/{companyId}/tools/policies/reorder; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-tools-policies
API: present — POST /api/companies/{companyId}/tools/policies; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-tools-policies-duplicate
API: present — POST /api/companies/{companyId}/tools/policies/{policyId}/duplicate; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
patch-companies-tools-policies
API: present — PATCH /api/companies/{companyId}/tools/policies/{policyId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
delete-companies-tools-policies
API: present — DELETE /api/companies/{companyId}/tools/policies/{policyId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-tools-trust-rules-revoke
API: present — POST /api/companies/{companyId}/tools/trust-rules/{policyId}/revoke; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-tools-policy-test
API: present — POST /api/companies/{companyId}/tools/policy/test; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
catalog-change
Capability ID: app-permissions/catalog-change.
Review: operation-reviewed.
post-tool-connections-catalog-refresh
API: present — POST /api/tool-connections/{connectionId}/catalog/refresh; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-tool-connections-catalog
API: present — GET /api/tool-connections/{connectionId}/catalog; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-tool-profiles-new-tools
API: present — GET /api/tool-profiles/{profileId}/new-tools; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — authenticated fixtures exercise saved application/catalog/tool-name/risk selectors, allow-all profiles, managed empty profiles, personal-account visibility, and scoped grants through actual keys and run JWTs.
Verification: passed — local assembled server and real database; inaccessible profile resources are omitted from lists and denied before new-tool or effective-profile data is returned. Proposed broad entries and installed connections use the same authority checks.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-tool-profiles-new-tools-review
API: present — POST /api/tool-profiles/{profileId}/new-tools/review; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_profiles; mutations whose entry selectors resolve connections also require tools:manage_connections. shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
test-action
Capability ID: app-permissions/test-action.
Review: operation-reviewed.
get-companies-tools-action-requests
API: present — GET /api/companies/{companyId}/tools/action-requests; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-tool-connections-test-agents
API: present — GET /api/tool-connections/{connectionId}/test-agents; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-tool-connections-test-agents-access
API: present — GET /api/tool-connections/{connectionId}/test-agents/{agentId}/access; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-connections-test-calls
API: present — POST /api/tool-connections/{connectionId}/test-calls; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:use, responsible-user credential access and target-agent authority. Testing another agent also requires the caller’s full tool access decision (effective profiles, explicit grants, and action policies) and both principals to select the same credential identity, regardless of the connection’s auth label. Caller and target action policies apply before dispatch and after approval; either Ask first decision requires ordinary human approval. Shared rate buckets consume one slot per test. A successful yielded run may continue only while current user, agent, task, and grant authority remain valid.
Evidence: verified — assembled-server integration, actual bearer/session authentication, persisted PostgreSQL state, and deterministic local MCP/provider fixtures.
Verification: passed — 55-scenario fixture suite on a fresh isolated PostgreSQL database, including permitted policy/explicit grants without a caller profile, denied caller policies, dedicated credentials (including no-auth labels), caller-only approvals and rate limits, shared rates, private status reads, approved continuation, revocation, cancellation and replay. No live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
get-tool-connections-test-calls
API: present — GET /api/tool-connections/{connectionId}/test-calls/{actionRequestId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:use; shared management policy, originating-principal binding, and current linked-task read authorization. Agent and responsible-user task privacy checks apply even in shadow mode before exposing saved arguments or provider results.
Evidence: verified — assembled-server integration, actual persistent key/run JWT authentication and saved PostgreSQL state.
Verification: passed — own visible status returns 200; moving its invocation to an inaccessible private task causes 403 with both agent authentication paths. This regression was red before the fix.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-companies-tools-action-requests-trust-rule
API: present — POST /api/companies/{companyId}/tools/action-requests/{actionRequestId}/trust-rule; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
post-tool-gateway-action-requests-approve
API: present — POST /api/tool-gateway/action-requests/{id}/approve; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
post-tool-gateway-action-requests-decline
API: present — POST /api/tool-gateway/action-requests/{id}/decline; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
account-maintenance
Capability ID: app-permissions/account-maintenance.
Review: operation-reviewed.
get-companies-ai-connections-identity
API: present — GET /api/companies/{companyId}/ai-connections/{connectionId}/identity, optional grantId query; JSON REST.
Agent access: available — agent REST and default native search_api / call_api through the registered connection-management operation.
Policy: connections:read under current connection-management authority, active company membership, and the selected grant's human audience. Manager status alone cannot read a coworker's personal provider profile. Revoked or disabled accounts do not open credentials. No raw provider IDs or credentials are returned.
Evidence: verified — local PostgreSQL and actual key/JWT REST requests in connection-management integration, with provider fixtures. AI connection tests cover private-user and unauthenticated denial. Native API discovery is registered in OpenAPI; native tool execution is source-only.
Verification: passed — safe email/organization for an authorized selected grant; another company, another user, invalid grant, and missing authority denied before provider access. Profile permission denial remains an explicit unavailable observation rather than a failed connection. Fixtures do not qualify live provider profile access.
Gaps: Provider profile access depends on the saved token's scopes; an inference-only setup token cannot identify its account email.
get-companies-tools-apps-attention
API: present — GET /api/companies/{companyId}/tools/apps/attention; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-companies-tools-applications
API: present — GET /api/companies/{companyId}/tools/applications; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-tools-applications
API: present — POST /api/companies/{companyId}/tools/applications; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
patch-tool-applications
API: present — PATCH /api/tool-applications/{applicationId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
delete-tool-applications
API: present — DELETE /api/tool-applications/{applicationId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-companies-tools-connections
API: present — GET /api/companies/{companyId}/tools/connections; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
get-tool-connections
API: present — GET /api/tool-connections/{connectionId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-tool-connections-railway-ssh
API: present — POST /api/tool-connections/{connectionId}/railway/ssh; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-tool-connections-usage
API: present — GET /api/tool-connections/{connectionId}/usage; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-tool-connections-aggregator-apps
API: present — GET /api/tool-connections/{connectionId}/aggregator/apps; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-connections-aggregator-apps-sync
API: present — POST /api/tool-connections/{connectionId}/aggregator/apps/sync; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-connections-aggregator-apps-refresh
API: present — POST /api/tool-connections/{connectionId}/aggregator/apps/refresh; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
put-tool-connections-aggregator-discovery
API: present — PUT /api/tool-connections/{connectionId}/aggregator/discovery; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-tool-connections-composio-apps
API: present — GET /api/tool-connections/{connectionId}/composio/apps; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-connections-composio-apps-sync
API: present — POST /api/tool-connections/{connectionId}/composio/apps/sync; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-connections-composio-apps-refresh
API: present — POST /api/tool-connections/{connectionId}/composio/apps/refresh; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-connections-composio-apps-accounts
API: present — POST /api/tool-connections/{connectionId}/composio/apps/{toolkit}/accounts; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-connections-composio-apps-setup
API: present — POST /api/tool-connections/{connectionId}/composio/apps/{toolkit}/setup; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
patch-tool-connections
API: present — PATCH /api/tool-connections/{connectionId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user. Agents cannot replace channel credential references through this generic operation; provider setup owns credential validation and human verification-key entry.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server, including actual-JWT denial of a Slack signing-key reference replacement. Ordinary connection configuration remains permitted. No live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
delete-tool-connections
API: present — DELETE /api/tool-connections/{connectionId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-tool-connections-health-check
API: present — POST /api/tool-connections/{connectionId}/health-check; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-tool-connections-activity
API: present — GET /api/tool-connections/{connectionId}/activity; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:view_audit, shared management authority, and linked-task visibility. Pages are capped at 100 events; each distinct task is authorized once and the request's run capture is reused. Decisions are not retained across requests.
Evidence: verified — assembled-server integration, actual run JWT authentication and PostgreSQL event persistence.
Verification: passed — a 100-event page over two tasks returns its 50 visible events, with two capability decisions and at most two run captures (previously 100 and 102). Private events remain hidden; revoking audit permission makes the next request return 403.
Gaps: This internal audit-read proof does not qualify live provider setup or actions.