The egress.* family (1 verb). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Setegress.policy.set
| Property | Value |
|---|---|
| Capability | egress.policy |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Admin |
| Availability | On demand (MCP tier 2) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
Author the per-workspace outbound allow-list the dispatch
chokepoint enforces (SEC-F02). { rail, target, description? } - rail ∈ {CONNECTOR, MODEL,
WEBHOOK, DOC_ENGINE}; target is the allow-listed endpoint. An off-allow-list outbound call is a
fail-closed deny at enforce_egress. Idempotent (re-author the same (rail,target) is a no-op).
Call POST /v/egress.policy.set with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool egress.policy.set.