The session.* family (3 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Getsession.get
| Property | Value |
|---|---|
| Capability | actor.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
The CURRENT session’s own identity ([2026] CC-OPBOX 24 gate (b)): the
caller’s actor record, which the auth context names (ctx.actor.id) but no read verb surfaced - the
frontend had no whoami. Pure SELF-read: reads ONLY the caller’s own row (WHERE id = ctx.actor.id), so
there is NO cross-actor access surface to fence. Slim standing. No new store/write/state (extends the
existing session.* namespace - session.revoke - so it is not a Steering-#1 new-namespace breach).
Call POST /v/session.get with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool session.get.
Revokesession.revoke
| Property | Value |
|---|---|
| Capability | actor.write |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
Bump ONE user’s session_version (one user, all sessions). { actorId }. Idempotent-shaped (a re-revoke just bumps again, every prior bearer is already stale). A
bearer minted before the bumped generation is stale (the AuthContext resolver compare is the named
follow-on; the counter + the write path land here). Org-wide mass-revoke is org.freeze (EPIC-OPS).
Call POST /v/session.revoke with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Switchsession.workspace.switch
| Property | Value |
|---|---|
| Capability | actor.write |
| Risk class | Write - autonomy L1 |
| Min. permission | External (portal / signer token) |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
/Core ([2026] VJS-CC-OPBOX 11 C3). Switch the CURRENT session’s
active workspace. C3: re-checks access at EVERY call (fail-closed) against the union of HOME
(actor.workspace_id), workspace_access (actor-keyed), and OVERSEER membership of the target’s org;
Forbidden if the target is in none. A target == HOME RESETS to home (active_workspace_id = NULL). The choice
is persisted on the BEARER token; the resolver re-binds the data plane to it on the next call at the
CC-OPBOX 12 basis-derived tier (workspace_access -> MEMBER, OVERSEER-only -> read-only EXTERNAL, never the
home OWNER/ADMIN bypass). The floor is EXTERNAL so a read-only (OVERSEER-bound) session can still switch
back; the access re-check is the real authorisation. { workspaceId }.
Call POST /v/session.workspace.switch with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool session.workspace.switch.