The entity.* family (2 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Mirrorentity.edge.mirror
| Property | Value |
|---|---|
| Capability | entity.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
(system). Upsert a derived graph edge keyed (source_table,
source_row_id). The endpoints + relation_type + weight + metadata + org_group_id are refreshed on
conflict. orgGroupId is fenced to the caller’s org (fail-closed). relationType is validated non-empty;
the canonical allow-list (assertKnownRelationType) stays the FRONTEND caller’s pre-check. Returns
{ id, idempotent } (idempotent = the row already existed).
Call POST /v/entity.edge.mirror with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Unmirrorentity.edge.unmirror
| Property | Value |
|---|---|
| Capability | entity.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
(system). { sourceTable, sourceRowId }. Delete the mirrored edge
(org-group-fenced). Idempotent: a missing edge -> deleted:0. Returns { deleted }.
Call POST /v/entity.edge.unmirror with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.