Guardrails and approvals

Every capability declares three booleans and the surfaces it runs on. One authorization function reads them, and every module authorizes through it.

automationSafe

An agent, a service or partner portal automation may run it. When this is false, only a person may run it, on every surface, and never over MCP.

humanPresenceRequired

A person must be present. Only a human actor may run it, and never over MCP.

readOnly

It reads and never mutates. A portfolio read grant crosses workspaces for a read only capability and for nothing else.

Only two combinations are coherent, and the manifest refuses the others. A capability is either automation safe, or it is a human gate.

An agent cannot run a human gate. It can ask for one. The call creates an approval request and returns.

1. 01
   An agent calls a human-gated capability on the API, the CLI or MCP.
2. 02
   The dispatcher freezes the input and creates an approval request. Nothing runs.
3. 03
   A person lists the open requests and reads the frozen input.
4. 04
   The person approves or rejects. An approval runs the stored call as that person.

26 of the 93 declared capabilities are human gates. Every one of them is listed here, grouped by namespace.

Generated from shyftai/trumpet at cbc30f1 by scripts/gen-reference.mjs.

A served key is a bearer secret. It never carries human presence, so the dispatcher refuses a human actor on a served key and refuses any attempt to run a human gate directly.

• The workspace comes from the authenticated key, never from the body, the path or a header.
• A request that names another workspace is refused without reading that workspace.
• Only a peppered hash of the key is stored. The plaintext appears once, at mint.
• A revoked key fails closed.
• Minting a key is a human gate. Revoking one is not.

A partner credential resolves to exactly one partner grant. The grant carries the program, the relationship and the partner identity from the key record, never from the payload. An owner writes a guardrail on that grant with a call rate limit, a window, an allowed capability list and a submission limit.

Binding a partner key to a grant widens what the key can do, so partners:grantAccess is a human gate. Revoking a grant narrows access, so it stays automation safe. Every admitted or refused partner call appends one audit row.