Declare every right a tool's service enforces; plain words for unseen records and numbers
Approval follow-up 2026-10-21 (controller review of the approvals UI). Rights (item 4): an audit of every tool's declared rights against the rights its downstr...
Honour standing permissions; offer Approve and always allow on the card
CharterPolicy reads resolved.toolApprovals and each rule's standing flag. A member's rule about one tool stands for its class's rule for that tool; a standing p...
An approval card sends every parameter its phrase names
next-intl refuses an ICU select or plural with no value, so a phrase about an argument the SI left out (a contact with no formatted name, a new document categor...
An approval about a record the reader may not see never leaves a dangling 'for'
Phrases that named a patient, a customer, a purchaser, an envelope or a document after a preposition now say 'for a patient' (or nothing) when the reader may no...
Approval cards say SI in every label, write phone numbers and choices as people do, and keep a note beside an action a field
A humanised field name said 'Ai companion…' (now SI, with a guard that no phrase, label, noun or risk sentence says AI); a US number reads (512) 555-0142 in the...
Plain-language approval cards, worded as the reader may see them
Owner order 2026-10-20: approvals showed members GUIDs and JSON. POST **************** (internal auth) words each approval for a non-technical person: one sente...
Sms_read_attachment, and sms_read_thread names what was texted in (SITP MMS)
TP11 deferred sms_read_attachment because VOIPService kept no inbound MMS media; it does now (voipservice@8eda899). So: - sms_read_thread lists each inbound pa...
An SI on a teammate's order can find and operate just the function the order needs; on god's order also unverified ones (IoT R7 round 3)
- IotPack.planSend: when the SI's own view lacks the device or the function (or may not OPERATE it) and the caller is on an order-scoped session, IoTService's...
An order's tool call runs on a per-call scoped order session that lends only what the tool needs (No Insubordination Rule, IoT R7 round 3)
OrderDelegation.resolve takes a CallScope: the tools/list keeps the session lending the requester's whole standing (kamo:tool:order:<runId>), so the SI knows wh...
An SI on god's order sees and can ask for god's devices (IoT R7, No Insubordination Rule)
IotViewRules: an SI's manifest whose caller block names god's standing (caller.god PLATFORM | BREAK_GLASS) and the requester (caller.godOnOrderOf) keeps SAFETY_...
Mlos_update_section keeps what the call does not give (SITP TP21 live smoke)
The loan, property, declarations, military and row saves replace their whole section in SecurityService, so a partial edit would have cleared the fields it left...
Mortgage loan files for SIs: pipeline, the application, readiness, conditions, documents, disclosures, pricing and locks, AUS, vendor orders, consent and the edits (SITP TP21)
43 mlos_* tools (MlosPack) through SecurityService's loan-officer door **************** SITP TP21 securityservice@27e06020) as the SI member, never the MLOS ser...
Patient Records for SIs: the schedule, the front desk, chart and FHIR reads, note drafts and the revenue cycle, with payment posting (SITP TP23)
18 ehr_* tools (EhrPack) over SecurityService's EHR controllers as the SI member; each names the right SecurityService checks there, and anything inside one cha...
A loan record's dateUpdated is a UTC instant too (SITP TP22 live smoke)
The live smoke answered loans_get_state_rule and loans_history with dateCreated as a UTC instant and dateUpdated as KamoLOS's offset-less text; both are now ins...
Reports_save_view does not answer empty settings for a view it just saved (SITP TP16 live smoke)
SecurityService answers a save without the view's stored request (the list carries it), so the tool said parameters {} for a view saved with parameters. A view ...
Support tickets, system bugs, marketing materials, Growth Hub, tracking codes and social pages for SIs (SITP TP15)
54 new SI tools, each checked by the same rights at the gateway and at MediaService (DocsService for the materials list): - support_*: list (with the queue's co...
IoT field-service reads and alarm handling for SIs: sites, a customer's and a work order's devices, history, commands, an alarm, the summary, acknowledge several, shelve, unshelve, note (SITP TP19)
Eleven iot_* tools in the IoT pack, by its own conventions: offered per caller from the manifest (IotTools.RIGHT, the view's withholding reasons), every device,...
Personal loans for SIs: the book, payments, payoff, history, statements, fees, offers, promises to pay and the money acts (SITP TP22)
27 loans_* tools (LoansPack) straight to KamoLOS through its one-time-key door (SITP TP02, new downstream LOS, X-OTK) as the SI member; KamoLOS checks the PLOS ...
E-signatures for SIs: read a template, track sent documents and a record's requests, send, remind, resend, void (SITP TP19)
Eight esign_* tools (EsignPack) through a new ESIG(OTK) door to ESigService's staff API, as the SI member; ESigService checks every right itself (SITP TP02) and...
An SI prepares the draft commission payout batch, never sends it (SITP TP18)
commissions_draft_batch (open the DRAFT batch, or find the open one) and commissions_edit_draft_line (ADD / UPDATE / REMOVE a draft line; UPDATE restates the wh...
The organization's web analytics for SIs: websites, traffic, top pages and sources (SITP TP16)
analytics_list_websites, analytics_website_stats (views, visitors, visits, bounces, time on site, the period before, who is on now), analytics_website_metrics (...
The tool lists gain exactly SITP TP16's four saved-view tools and reports_run's viewId
Snapshots regenerated on top of TP17 and TP18: reports_run changes (viewId); every other change is a new reports_*_view tool.
Saved report views for SIs: list, save, delete, share, and reports_run by viewId (SITP TP16)
reports_list_views, reports_save_view (create or change; a change keeps what it does not name), reports_delete_view, reports_share_view (SHARE_REPORTS; the endp...
An SI reads its own and its managed members' work, and cancels its own queued sends (SITP TP20)
Owner decision 2 (2026-10-18). Eleven AI_ONLY tools, each calling the owning service as the SI itself (its own session; new KamoService.KAMOAI door), which scop...
Plans & Billing for SIs: plan, catalogue, accounts, seats, invoices, usage, provider status, seat assign and remove (SITP TP18)
Nine billing_* tools (BillingPack) through SecurityService's billing door (SITP TP02's BillingRelayController; TP18 added the licensee step and the usage reads)...
Timecards, leave, breaks and attendance, payroll reads and commission reads for SIs (SITP TP18)
25 tools, so an SI does in HR -> Attendance, Payroll and My Commissions what a person does, within its rights, through SecurityService's TimecardController, Pay...
A scheduled report reaches a colleague who signs in on another domain (SITP TP16 live smoke)
reports_schedule judged a colleague by the organization's mail domains alone, so in sp00verify the owner's own sign-in address was refused as an outsider. A rec...
Quotes, service work, orders, the commerce pipeline and catalog, subscriptions and reserved opportunities for SIs (SITP TP17)
86 tools over SecurityService as the SI member, each right checked there as well as here: - quotes_*: find, read (share links never carry their address), create...
Binders_create sends what CreateBinderRequest reads; scripts_create names a market by its leads_list_markets id (SITP TP14 live smoke)
DocsService refused every binders_create: CreateBinderRequest's primitive isTemplate binds as "template", so the body's isTemplate was an unknown field (400). A...
The tool lists gain exactly SITP TP16's 30 tools and reports_run's page
Snapshots regenerated (-Dtoolplane.parity.write / -Dtoolplane.golden.write) on top of TP14: the only changed entry is reports_run (page, and its description); e...
Report options, export, paging and schedules; rights explained; org structure; settings screens by their rights (SITP TP16)
30 new SI tools, each asking the right the screen's endpoint checks (rights enforced twice): - reports_options (a picker's live choices), reports_run pages thro...
Documents, KB writing and review, careers screening, checklists, sales scripts and binders for SIs (SITP TP14)
84 tools and docs_search filters, so an SI can do in Docs, the knowledge base, HR careers, checklists, sales scripts and binders what a person does, within its ...
Chat_send_file posts a text document DocsService typed octet-stream as text/plain (SITP TP13)
DocsService records Markdown, YAML, logs and other text without an ImageMimeType as application/octet-stream, which chat's attachment allow-list refuses. A docu...
StrictReadTest expects a withheld SI card to be passed on as the DM it learned from
Since c13c47b (ruling CP07-T43-1/-7) a withheld record no person owns or takes part in stands in the withheld store for its inherited sources the audience may n...
The tool lists gain exactly SITP TP12's 25 tools, calendarId and the IoT/RPM notification kinds
Snapshots regenerated (-Dtoolplane.parity.write / -Dtoolplane.golden.write): the only changed entries are calendar_create_event (calendarId) and notifications_l...
An SI records or withdraws a lead's call consent (SITP TP11)
leads_record_voice_consent and leads_withdraw_voice_consent over SecurityService's PUT/DELETE /leads/{id}/ai-voice-consent (authorized there like editing the le...
Meetings history and transcripts, calendar answers, presence, notification dismiss/snooze, webinars (SITP TP12)
25 new SI tools, each checked by the same rights at the gateway and at the owning service: - meetings_history, meetings_get, meetings_get_transcript (MEETING, p...
Lead callbacks take MANAGE_LEAD_CALLBACKS, as SecurityService now does (SITP TP10, after TP01)
Files_upload sends the type and digests ConversionService checks (SITP TP13)
ConversionService detects a file's type from its bytes and name and refuses a declared type that differs, then compares the client's Blake3 and SHA3-256 digests...
Files_upload files into My Docs by its ordinal (SITP TP13)
ConversionService refuses an upload whose metadata names no assocType (values()[assocType]), and its own no-metadata default (4) is MEET_RECORDING's ordinal. fi...
Leads, accounts and communications timelines for SIs (SITP TP10)
54 tools over SecurityService as the SI member, each right checked there as well as here: - leads: create, edit (masked values never written back), assign, bulk...
Shared mailboxes, folders, stars, Trash, labels, attachments in and out, group chats, drips, files_upload, contact groups (SITP TP13)
27 tools and two new arguments, so an SI can work its mail and chat as a person does: - mail: mail_list_folders, mail_flag, mail_delete (to Trash only; a messa...
The phone inbox, the do-not-contact list, contact call consent, text templates and MMS (SITP TP11)
22 new SI tools, each checked by the same rights at the gateway and at VOIPService/EmailService: - phone_list_voicemail, phone_voicemail_mark_read, phone_voicem...
Every SI gets the report tools by its rights; config_* gated by rights, not audience
SITP TP00, owner decisions 2026-10-18: - reports_list, reports_run and metrics_get drop CP14's WATCH charter switch: an SI is offered them by VIEW_REPORTS and...
Stop logging the database password at startup
com.zaxxer.hikari at DEBUG makes HikariConfig print its whole configuration on every start, including dataSourceProperties {password=...} and password......; Pr...
Classify the ten iot tools; the catalogue guards move 101 to 111 (SP11 P12)
The three iot writes are NOT_DISCLOSING and the seven reads NOT_CONTENT with the spec's reasons (pinned in ContentReadToolsCoverageTest too). RegistryCompletene...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.