The data.* family (1 verb). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Feeddata.audit.feed
| Property | Value |
|---|---|
| Capability | audit.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
A SCOPED PROJECTION of the agent-action stream
over the immutable event log - it DELEGATES to management::audit_query (INV-6 - NO new store; the
SoR is the one event log). It narrows the feed to the data-plane: a tableId/matterId scopes the
view (a retrospective “what did the agents do to this table/matter”), an actorId/verb filters
further. RLS-scoped + IDOR-scoped by construction (audit_query carries the explicit workspace_id = $
predicate, so a cross-workspace event is unreachable). Computes nothing authoritative (INV-14).
Input { tableId?, matterId?, actorId?, verb?, limit? } (fields ending in ? are optional)
Call POST /v/data.audit.feed with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.