The cross-jurisdiction-transfer.* family (1 verb). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
cross-jurisdiction-transfer.record
| Property | Value |
|---|---|
| Capability | oversight.write |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Member |
| Availability | On demand (MCP tier 2) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
(DEFERRED). Append a cross-border transfer
record. RLS scope = source_workspace_id = ctx.workspace_id. { fileId, grantId, targetWorkspaceId, sourceJurisdiction, targetJurisdiction, authorisedById, legalBasis?, consentRecordId? }.
Call POST /v/cross-jurisdiction-transfer.record with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool cross-jurisdiction-transfer.record.