Create policy
Create tool permission
Policies
Select a principal to view or create policies.
Tool permissions
Select a policy to inspect current tool permissions.
Tool catalog
Tap a tool to prefill the permission form with a governed target.
add_system_note
writesystems � Append an operational note to a system.
approve_deployment
writedeployments � Approve a pending deployment.
assign_system_responsibility
writesystems � Assign an owner or operator to a system.
create_container
writesystems � Add a container record to a system.
create_service_endpoint
writesystems � Add a service endpoint to a container.
create_system
writesystems � Create a new system inventory record.
create_wiki_commit_job
writeknowledge � Create a commit/push job for pending wiki edits.
execute_wiki_commit_job
writeknowledge � Execute a pending wiki commit job immediately.
get_control_room_overview
readcontrol-room � Fetch the current Control Room overview snapshot.
get_deployment
readdeployments � Fetch a single deployment record.
get_system_detail
readsystems � Read the full inventory record for a system.
get_wiki_commit_job
readknowledge � Read the status of a wiki commit job.
hetzner.costs.recalculate
writecosts � Force a Hetzner cost recalculation for the selected scope.
hetzner.costs.resources.list
readcosts � List estimated Hetzner cost line items by resource.
hetzner.costs.summary
readcosts � Read the current estimated Hetzner 30-day cost summary.
hetzner.costs.trend
readcosts � Read the daily Hetzner cost trend series.
hetzner.pricing_map.import
writecosts � Import or replace the active Hetzner pricing map.
hetzner.provision_network_security
writeoperations � Create or repair the managed Hetzner private network, subnet, firewall, and generated GitHub Actions secrets for an environment.
host.agent.end
writeoperations � End an active host repair session.
host.agent.exec
writeoperations � Execute an approved host repair command within an active session.
host.agent.logs
writeoperations � Read bounded service, container, or file logs within an active host repair session.
host.agent.start
writeoperations � Start an ephemeral host repair session for a specific environment.
index_repository
writesources � Index repository content for search and knowledge discovery.
knowledge.add_to_wiki
writeknowledge � Create an intake draft under /drafts and prepare ranked merge targets.
knowledge.draft_intake.get
readknowledge � Read a wiki draft intake record.
knowledge.draft_merge.accept
writeknowledge � Accept a draft merge preview and write a new revision to the target page.
knowledge.draft_merge.preview
writeknowledge � Generate a reviewable merge preview for a selected target page.
knowledge.draft_merge.reject
writeknowledge � Reject a draft merge preview without modifying the target page.
knowledge.draft_suggestions.list
readknowledge � List ranked target-page suggestions for a draft intake.
knowledge.draft_target.select
writeknowledge � Select a target page for a wiki draft intake.
knowledge.tree.list
readknowledge � List the wiki hierarchy for manual target selection.
list_repositories
readsources � List tracked repository mirrors and sync/index status.
list_service_deployments
readdeployments � List recent deployments for a service.
list_systems
readsystems � List active systems in the Control Room inventory.
list_wiki_commit_jobs
readknowledge � List recent wiki commit jobs for a repository.
migrations.discovery.start
writemigrations � Start a discovery run for a migration project.
migrations.execution.cutover
writemigrations � Request or perform migration cutover after required validation gates pass.
migrations.execution.get
readmigrations � Read a migration execution with step and validation state.
migrations.execution.rollback
writemigrations � Request or perform rollback for a migration execution.
migrations.execution.start
writemigrations � Start a governed migration execution from an approved migration plan.
migrations.execution.validate
writemigrations � Run or refresh validation gates for a migration execution.
migrations.get
readmigrations � Read a migration project and its target profile.
migrations.list
readmigrations � List migration projects and their current states.
migrations.plan.generate
writemigrations � Generate a migration plan with validation and rollback checkpoints.
migrations.plan.get
readmigrations � Read a generated migration plan with ordered steps and environment mappings.
read_wiki_document
readknowledge � Read a wiki or markdown document from a mirrored repository.
refresh_ghcr_credentials
writeoperations � Refresh REGISTRY_URL and REGISTRY_USERNAME for a GitHub environment. GHCR deployments use the GitHub Actions GITHUB_TOKEN.
reject_deployment
writedeployments � Reject a pending deployment.
request_deployment_approval
writedeployments � Create an approval request for a deployment.
request_rollback
writedeployments � Request a rollback to an earlier deployment.
search_docs
readknowledge � Search indexed markdown and code content across configured repositories.
sync_repository
writesources � Run repository synchronization against origin.
systems.windows.image_build_runs.create
writesystems � Trigger a new Windows golden image build run.
systems.windows.image_build_runs.get
readsystems � Get a Windows image build run.
systems.windows.image_families.create
writesystems � Create a Windows golden image family for Hetzner automation.
systems.windows.image_families.list
readsystems � List Windows golden image families through the image catalog.
systems.windows.image_versions.approve
writesystems � Approve a Windows image version for deployment.
systems.windows.image_versions.deprecate
writesystems � Deprecate a Windows image version.
systems.windows.image_versions.get
readsystems � Get a Windows image version with build lineage and linked servers.
systems.windows.image_versions.list
readsystems � List Windows image versions with approval and lifecycle state.
systems.windows.image_versions.reject
writesystems � Reject a Windows image version.
systems.windows.image_versions.set_default
writesystems � Mark an approved Windows image version as the default deployment image.
systems.windows.servers.deploy
writesystems � Deploy a managed Windows server from an approved image.
systems.windows.servers.get
readsystems � Get a managed Windows server with provisioning details.
systems.windows.servers.list
readsystems � List managed Windows servers deployed from golden images.
update_markdown_document
writeknowledge � Update markdown content in a controlled wiki repository.
update_system
writesystems � Update an existing system inventory record.
wiki.add_diary_entry
writeknowledge � Append to the Developer diary, creating the day page when needed.
wiki.append_note
writeknowledge � Append a timestamped note to an existing wiki page and create a revision.
wiki.register_repository
writesources � Register a Git repository and one or more mirror profiles for mirrored wiki content.
wiki.search
readknowledge � Search wiki pages with unified ranking across native, seeded, and mirrored content, including source labels and optional filters.
wiki.sync_repository
writesources � Sync a registered repository and refresh mirrored wiki pages and search results.
windows.vm.create
writesystems � Create a disposable Windows VM and return a one-time Administrator password.
windows.vm.delete
writesystems � Delete a disposable Windows VM instance.
windows.vm.list
readsystems � List disposable Windows VM instances.
windows.vm.recreate
writesystems � Recreate a disposable Windows VM with a new one-time Administrator password.