The object.* family (1 verb). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Setobject.visibility.set
| Property | Value |
|---|---|
| Capability | acl.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Member |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
where visibility ∈ {workspace, restricted}. WRITE/L1/MEMBER.
Flips the object’s visibility grade. Requires the caller to hold at least manage (3) on the object
(the owner, an explicit manager, or admin oversight) - restricting an object is a confidentiality act,
not a casual edit. Anti-enumeration: an unreachable object reads back not-found.
Input { objectType, objectId, visibility } (fields ending in ? are optional)
Call POST /v/object.visibility.set with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.