Access control

Inbox

Incoming agent requests for resources owned by Monica (CFO). Approve mints exactly the requested scope; a salary request is forbidden with no approve path.

Richard (CEO)'s agent

agent:cto/1

escalate

“To judge whether this month's Claude spend is net-justified after credits.”

query view(stripe, finance_private)
fields: [gross, credits, discount_tier]
rows: team ∈ {eng, ops, sales, finance}
doc: finops · ttl: 7d

Dinesh (CTO)'s agent

agent:eng/1

forbidden

“Wants to benchmark team comp against spend.”

query view(stripe, finance_private)
fields: [employee_salary]
rows: team ∈ all
doc: finops · ttl: 7d

⛔ employee_salary is never delegable — no approval path exists (salary invariant).

Audit trail

Approve or deny a request to populate the audit trail.