The fria.* family (4 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Approvefria.approve
| Property | Value |
|---|---|
| Capability | compliance.write |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Owner |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
: approve a SUBMITTED FRIA, stamping approved_at + an expiry (default 365 days; a FRIA is re-assessed when the use materially changes). The later FRIA-egress gate treats a HIGH-risk org with no current APPROVED non-expired FRIA for the vertical as ungated-egress -> deny (assented acts route-for-correction). Fail-closed unless the source is SUBMITTED.
Call POST /v/fria.approve with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Listfria.list
| Property | Value |
|---|---|
| Capability | compliance.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
: the org’s FRIAs (the read-home; the OWNER + the later egress-gate read this).
Call POST /v/fria.list with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool fria.list.
Proposefria.propose
| Property | Value |
|---|---|
| Capability | compliance.write |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Owner |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
: open a DRAFT Fundamental-Rights Impact Assessment (Art.27) for an org +
Annex III vertical. The tenant authors the content (body, optional at draft); Opbox records + audits it.
Call POST /v/fria.propose with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Reviewfria.review
| Property | Value |
|---|---|
| Capability | compliance.write |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Owner |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
: move a DRAFT FRIA to SUBMITTED (ready for approval). Fail-closed on any other source status (an APPROVED/EXPIRED record is not re-submitted here - the chain is the history).
Call POST /v/fria.review with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.