Permissions

Sharing, roles and access rules.

12 tools — 4 read, 8 write.

Tool		What it does
block_agent_resource	write	Block (or unblock) one of your agents from every tool on a specific resource.
clear_agent_rule	write	Remove your own agent governance rule for a capability.
create_permission_rule	write	Create a permission rule.
delete_permission_rule	write	Delete a permission rule by id.
get_agent_rules	read	List your own agent governance rules.
list_agent_resource_blocks	read	List the agents blocked from every tool on a resource.
list_item_shares	read	List item shares in the active org.
list_permission_rules	read	List permission rules in the active org.
set_agent_rule	write	Set your own agent governance rule (allow / ask / deny) for a capability.
share_item	write	Grant a user, role, agent, or 'everyone' access to a specific resource at viewer/editor/owner level.
unshare_item	write	Revoke a previously-granted item share by id.
update_permission_rule	write	Update a permission rule by id (effect, conditions, description, expiry).

Calling these

Over MCP, find one with search_tools, then run it with execute_tool. Over REST, POST /api/capabilities/<tool> with the arguments as the JSON body. Either way, fetch the input schema for the tool you're about to call rather than guessing — get_tool_schema over MCP, or GET /api/capabilities?name=<tool> over REST.

See How the API works for auth, errors and the shared envelope.