The embed.* family (4 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Deleteembed.delete
| Property | Value |
|---|---|
| Capability | knowledge.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
AdminOnly (DEFERRED). Deletes BOTH the chunks + the status sidecar for a source in one
verb tx, workspace-scoped. { sourceType, sourceId }.
Call POST /v/embed.delete with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Indexembed.index
| Property | Value |
|---|---|
| Capability | knowledge.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Member |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | In-box model - the co-located embedding model (exempt from the per-workspace allow-list) |
| Budget-gated | Refused when the workspace AI budget is exceeded (Owner break-glass audited) |
A write operation in the embed.* family. Called through the one governed front door: capability, permission tier, autonomy, scope and egress are all resolved before the handler runs, and the call is audited (INV-1, INV-8).
Call POST /v/embed.index with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Queryembed.query
| Property | Value |
|---|---|
| Capability | knowledge.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | In-box model - the co-located embedding model (exempt from the per-workspace allow-list) |
| Budget-gated | Refused when the workspace AI budget is exceeded (Owner break-glass audited) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
A read operation in the embed.* family. Called through the one governed front door: capability, permission tier, autonomy, scope and egress are all resolved before the handler runs, and the call is audited (INV-1, INV-8).
Call POST /v/embed.query with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Setembed.status.set
| Property | Value |
|---|---|
| Capability | knowledge.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
AdminOnly (DEFERRED). Upsert on (workspace_id, source_type, source_id, source_field).
{ sourceType, sourceId, sourceField, status, contentHash?, chunkCount?, tokenCount?, error? }.
Call POST /v/embed.status.set with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.