Authentication

List and retrieve documents, packages, versions, and metadata.

Create, update, and delete documents and their metadata.

Read raw document content blocks and structured content trees.

Reserved: modify document content blocks and structured content trees. No public operation is gated by this scope yet; it is not grantable until a content-write API ships.

Reserved: list and download document assets. No public operation is gated by this scope yet; it is not grantable until an assets API ships.

Reserved: upload, replace, and delete document assets. No public operation is gated by this scope yet; it is not grantable until an assets API ships.

List and read comment threads and suggestions.

Create, edit, and resolve comment threads and suggestions.

Search documents, content, and metadata across the workspace.

Access document engagement and usage analytics.

Read document workflow state, available transitions, and approval history.

Trigger workflow transitions and submit approvals.

Export documents to PDF, DOCX, and Markdown formats.

Read project and engagement identity, lifecycle state, membership, and settings without financial details.

Create, update, archive, and manage project/engagement identity, membership, and settings through confirmed commands.

Customer and commercial-engagement identity, hierarchy, status, and engagement-project links (read-only). No financials, rates, or contract terms.

Acknowledge advisory Project Health alerts through confirmed, idempotent commands.

Read project financial health: budget, margin, burn rate, and forecasts. Equivalent to the revops:view_margin session permission.

Read project staffing status: role coverage, discipline gaps, open requests, and delivery risk signals. Equivalent to the revops:view_capacity session permission.

Read agent-optimized project delivery, sprint, and risk read models via the Agent API (/api/agent/v1). Directional signals only — no rates, invoice data, or personal metadata.

Search and inspect governed context packages, evidence references, provenance, freshness, coverage, and contributing providers.

Record a Context Opportunity — an evidence-backed, advisory proposal that some governed domain may warrant an action. Never approves, mutates, or promotes governed truth; creates ONLY an opportunity record.

Read governed delivery milestones, workstreams, and timeline geometry without moving execution coordinates.

Run explicit milestone status, target-date, and progress commands through the governed Delivery command path.

Read project-scoped estimates, effort, role demand, scope, immutable versions, and comparisons.

Create estimates, update bounded draft metadata, and persist reviewable estimate change proposals.

Request human baseline review or explicitly freeze an immutable estimate baseline.

Read sprint planning context, readiness, reports, and proposal-only planning suggestions. Does not apply plans or move work.

List and retrieve canonical Execute work items, transition history, and read-only board projections.

Create and edit authorized work-item comments, including provider writeback when the source owns comments.

Apply valid Execute or provider-backed workflow transitions with audit history.

Assign, reassign, or unassign eligible owners without granting staffing or capacity authority.

Set or clear governed date and sprint placement fields through the Execute command boundary.

Set or clear points/estimate fields without exposing commercial rates, margins, or subscription data.

Manage labels and normalized work-item relationships such as dependencies, related, duplicates, and parent/child links.

Raise, update, transition, and resolve blockers linked to work items.

Pin, annotate, reprioritize, snooze, or clear work items in governed focus views.

Run bounded, confirmation-required bulk operations across authorized work items.

Read Work Item Enhance runs, generated drafts, artifacts, evidence references, and apply history.

Create proposal-first Work Item Enhance runs and execute bounded enhancement actions.

Apply selected Work Item Enhance drafts back to authorized canonical work-item fields.

Inspect authorized repository/code context for Work Item Enhance implementation planning without writing code.

List and retrieve revenue opportunities and delivery forecasts.

Read the account-level audit event stream. Requires an Enterprise plan and the audit:account.view session permission. Equivalent to viewing the account audit dashboard.

Create, update, delete, and inspect webhook registrations.

Read the authenticated user's time entries and time-management state.

Create and change explicit time entries for the authenticated user. Inferred time remains proposal-only.

Submit or recall the authenticated user's reviewed work day. Never grants approval authority.

Read only time submissions the authenticated user is eligible to review in the active workspace.

Approve or reject time submissions where the authenticated user is an eligible approver.

Start provider-backed time import runs for the authenticated user with immutable source identity.

Read and resolve authorized provider reconciliation findings without changing provider authority.

Wildcard over every scope-gated operation — equivalent to holding every scope. Deliberately does NOT satisfy capability-gated routes (financial health, staffing status, audit log, delivery forecast): those require session authentication regardless of key scopes. Use with care.