{
  "schemaVersion": 1,
  "apiVersion": "v1",
  "operationPolicy": [
    { "operationId": "getApiVersion", "method": "GET", "path": "/", "scope": null, "sdk": "system.getApiVersion", "cli": "api-version", "mcp": { "exposure": "forbidden", "reason": "Transport metadata is not a user task." } },
    { "operationId": "exchangeCliAuthorizationCode", "method": "POST", "path": "/auth/cli/token", "scope": null, "sdk": null, "sdkExclusionReason": "Fixed first-party public-client protocol used only by the TeamGrid CLI browser-login implementation.", "cli": "auth login", "mcp": { "exposure": "forbidden", "reason": "Interactive human authorization must never run inside an MCP stdio process." } },
    { "operationId": "compensateCliAuthorizationStorage", "method": "POST", "path": "/auth/cli/storage-compensation", "scope": null, "sdk": "authorization.compensateCliStorage", "cli": "auth login", "mcp": { "exposure": "forbidden", "reason": "Credential storage recovery is a narrowly bound CLI protocol operation and must never run inside an MCP stdio process." } },
    { "operationId": "getCurrentCredentialContext", "method": "GET", "path": "/auth/context", "scope": null, "sdk": "authorization.getContext", "cli": "auth status", "mcp": { "exposure": "forbidden", "reason": "Credential identity and scope metadata are authentication diagnostics and must not enter an MCP transcript." } },
    { "operationId": "revokeCurrentCredential", "method": "DELETE", "path": "/auth/context", "scope": null, "sdk": "authorization.revokeCurrentCredential", "cli": "auth logout", "mcp": { "exposure": "forbidden", "reason": "Credential revocation must remain an explicit human-controlled authentication action outside MCP." } },
    { "operationId": "getSystemCapabilities", "method": "GET", "path": "/system/capabilities", "scope": "workspace:read", "sdk": "system.getCapabilities", "cli": "system capabilities", "mcp": { "exposure": "forbidden", "reason": "Capability negotiation is transport metadata and does not need a separate MCP tool." } },
    { "operationId": "getWorkspace", "method": "GET", "path": "/workspace", "scope": "workspace:read", "sdk": "workspace.get", "cli": "workspace", "mcp": { "exposure": "read", "tool": "teamgrid_workspace_get" } },
    { "operationId": "getWorkspaceEntitlements", "method": "GET", "path": "/workspace/entitlements", "scope": "workspace:read", "sdk": "workspace.getEntitlements", "cli": "workspace entitlements", "mcp": { "exposure": "forbidden", "reason": "Workspace entitlement metadata is intentionally not exposed to MCP." } },
    { "operationId": "getWorkspaceSettings", "method": "GET", "path": "/workspace/settings", "scope": "workspace-settings:read", "sdk": "workspaceSettings.get", "cli": "workspace-settings get", "mcp": { "exposure": "forbidden", "reason": "Workspace administrative settings are forbidden in every MCP profile." } },
    { "operationId": "updateWorkspaceSettings", "method": "PATCH", "path": "/workspace/settings", "scope": "workspace-settings:write", "sdk": "workspaceSettings.update", "cli": "workspace-settings update", "mcp": { "exposure": "forbidden", "reason": "Workspace administrative settings writes are forbidden in every MCP profile." } },
    { "operationId": "listPersonalAccessTokens", "method": "GET", "path": "/me/personal-access-tokens", "scope": "credentials:read", "sdk": "personalAccessTokens.list", "cli": "credentials personal list", "mcp": { "exposure": "forbidden", "reason": "Credential metadata and secrets are forbidden in every MCP profile." } },
    { "operationId": "createPersonalAccessToken", "method": "POST", "path": "/me/personal-access-tokens", "scope": "credentials:write", "sdk": "personalAccessTokens.create", "cli": "credentials personal create", "mcp": { "exposure": "forbidden", "reason": "Reveal-once credentials must never enter an AI transcript." } },
    { "operationId": "rotatePersonalAccessToken", "method": "POST", "path": "/me/personal-access-tokens/{id}/rotation", "scope": "credentials:write", "sdk": "personalAccessTokens.rotate", "cli": "credentials personal rotate", "mcp": { "exposure": "forbidden", "reason": "Reveal-once credentials must never enter an AI transcript." } },
    { "operationId": "revokePersonalAccessToken", "method": "DELETE", "path": "/me/personal-access-tokens/{id}", "scope": "credentials:write", "sdk": "personalAccessTokens.revoke", "cli": "credentials personal revoke", "mcp": { "exposure": "forbidden", "reason": "Credential administration is forbidden in every MCP profile." } },
    { "operationId": "listServiceAccounts", "method": "GET", "path": "/service-accounts", "scope": "service-accounts:read", "sdk": "serviceAccounts.list", "cli": "service-accounts list", "mcp": { "exposure": "forbidden", "reason": "Principal and credential administration is forbidden in every MCP profile." } },
    { "operationId": "createServiceAccount", "method": "POST", "path": "/service-accounts", "scope": "service-accounts:write", "sdk": "serviceAccounts.create", "cli": "service-accounts create", "mcp": { "exposure": "forbidden", "reason": "Reveal-once service credentials must never enter an AI transcript." } },
    { "operationId": "getServiceAccount", "method": "GET", "path": "/service-accounts/{id}", "scope": "service-accounts:read", "sdk": "serviceAccounts.get", "cli": "service-accounts get", "mcp": { "exposure": "forbidden", "reason": "Principal and credential administration is forbidden in every MCP profile." } },
    { "operationId": "updateServiceAccount", "method": "PATCH", "path": "/service-accounts/{id}", "scope": "service-accounts:write", "sdk": "serviceAccounts.update", "cli": "service-accounts update", "mcp": { "exposure": "forbidden", "reason": "Principal administration is forbidden in every MCP profile." } },
    { "operationId": "revokeServiceAccount", "method": "DELETE", "path": "/service-accounts/{id}", "scope": "service-accounts:write", "sdk": "serviceAccounts.revoke", "cli": "service-accounts revoke", "mcp": { "exposure": "forbidden", "reason": "Principal administration is forbidden in every MCP profile." } },
    { "operationId": "createServiceAccountCredential", "method": "POST", "path": "/service-accounts/{id}/credentials", "scope": "credentials:write", "additionalScopes": ["service-accounts:write"], "sdk": "serviceAccounts.createCredential", "cli": "service-accounts credentials create", "mcp": { "exposure": "forbidden", "reason": "Reveal-once service credentials must never enter an AI transcript." } },
    { "operationId": "rotateServiceAccountCredential", "method": "POST", "path": "/service-accounts/{id}/credentials/{credentialId}/rotation", "scope": "credentials:write", "additionalScopes": ["service-accounts:write"], "sdk": "serviceAccounts.rotateCredential", "cli": "service-accounts credentials rotate", "mcp": { "exposure": "forbidden", "reason": "Reveal-once service credentials must never enter an AI transcript." } },
    { "operationId": "revokeServiceAccountCredential", "method": "DELETE", "path": "/service-accounts/{id}/credentials/{credentialId}", "scope": "credentials:write", "additionalScopes": ["service-accounts:write"], "sdk": "serviceAccounts.revokeCredential", "cli": "service-accounts credentials revoke", "mcp": { "exposure": "forbidden", "reason": "Credential administration is forbidden in every MCP profile." } },
    { "operationId": "getServiceAccountResourceGrants", "method": "GET", "path": "/service-accounts/{id}/resource-grants", "scope": "resource-grants:read", "additionalScopes": ["service-accounts:read"], "sdk": "serviceAccounts.getResourceGrants", "cli": "service-accounts grants get", "mcp": { "exposure": "forbidden", "reason": "Principal authorization policy is forbidden in every MCP profile." } },
    { "operationId": "replaceServiceAccountResourceGrants", "method": "PUT", "path": "/service-accounts/{id}/resource-grants", "scope": "resource-grants:write", "additionalScopes": ["service-accounts:write"], "sdk": "serviceAccounts.replaceResourceGrants", "cli": "service-accounts grants replace", "mcp": { "exposure": "forbidden", "reason": "Principal authorization policy writes are forbidden in every MCP profile." } },
    { "operationId": "getEventCatalog", "method": "GET", "path": "/events/catalog", "scope": "events:read", "sdk": "events.getCatalog", "cli": "events catalog", "mcp": { "exposure": "forbidden", "reason": "Event capability discovery is a synchronization primitive and does not need a separate MCP tool." } },
    { "operationId": "listChanges", "method": "GET", "path": "/changes", "scope": "changes:read", "sdk": "changes.list", "cli": "changes list", "mcp": { "exposure": "forbidden", "reason": "The resumable synchronization feed is high-volume transport infrastructure and is forbidden in every MCP profile." } },
    { "operationId": "listAppointments", "method": "GET", "path": "/appointments", "scope": "appointments:read", "sdk": "appointments.list", "cli": "appointments list", "mcp": { "exposure": "forbidden", "reason": "Calendar data can expose personal schedules and remains forbidden in every MCP profile." } },
    { "operationId": "createAppointment", "method": "POST", "path": "/appointments", "scope": "appointments:write", "sdk": "appointments.create", "cli": "appointments create", "mcp": { "exposure": "forbidden", "reason": "Calendar writes and delegated acting-user operations are forbidden in every MCP profile." } },
    { "operationId": "getAppointment", "method": "GET", "path": "/appointments/{id}", "scope": "appointments:read", "sdk": "appointments.get", "cli": "appointments get", "mcp": { "exposure": "forbidden", "reason": "Calendar data can expose personal schedules and remains forbidden in every MCP profile." } },
    { "operationId": "updateAppointment", "method": "PATCH", "path": "/appointments/{id}", "scope": "appointments:write", "sdk": "appointments.update", "cli": "appointments update", "mcp": { "exposure": "forbidden", "reason": "Calendar writes and delegated acting-user operations are forbidden in every MCP profile." } },
    { "operationId": "archiveAppointment", "method": "DELETE", "path": "/appointments/{id}", "scope": "appointments:write", "sdk": "appointments.archive", "cli": "appointments archive", "mcp": { "exposure": "forbidden", "reason": "Destructive calendar lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "restoreAppointment", "method": "POST", "path": "/appointments/{id}/restore", "scope": "appointments:write", "sdk": "appointments.restore", "cli": "appointments restore", "mcp": { "exposure": "forbidden", "reason": "Calendar lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "listAbsences", "method": "GET", "path": "/absences", "scope": "absences:read", "sdk": "absences.list", "cli": "absences list", "mcp": { "exposure": "forbidden", "reason": "Absence data can reveal sensitive personal availability and remains forbidden in every MCP profile." } },
    { "operationId": "createAbsence", "method": "POST", "path": "/absences", "scope": "absences:write", "sdk": "absences.create", "cli": "absences create", "mcp": { "exposure": "forbidden", "reason": "Absence writes and administrative acting-user operations are forbidden in every MCP profile." } },
    { "operationId": "getAbsence", "method": "GET", "path": "/absences/{id}", "scope": "absences:read", "sdk": "absences.get", "cli": "absences get", "mcp": { "exposure": "forbidden", "reason": "Absence data can reveal sensitive personal availability and remains forbidden in every MCP profile." } },
    { "operationId": "updateAbsence", "method": "PATCH", "path": "/absences/{id}", "scope": "absences:write", "sdk": "absences.update", "cli": "absences update", "mcp": { "exposure": "forbidden", "reason": "Absence writes and administrative acting-user operations are forbidden in every MCP profile." } },
    { "operationId": "archiveAbsence", "method": "DELETE", "path": "/absences/{id}", "scope": "absences:write", "sdk": "absences.archive", "cli": "absences archive", "mcp": { "exposure": "forbidden", "reason": "Destructive absence lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "restoreAbsence", "method": "POST", "path": "/absences/{id}/restore", "scope": "absences:write", "sdk": "absences.restore", "cli": "absences restore", "mcp": { "exposure": "forbidden", "reason": "Absence lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "listAvailability", "method": "GET", "path": "/availability", "scope": "availability:read", "sdk": "availability.list", "cli": "availability list", "mcp": { "exposure": "forbidden", "reason": "Derived personal availability and delegated calendar access remain forbidden in every MCP profile." } },
    { "operationId": "listActivity", "method": "GET", "path": "/activity", "scope": "activity:read", "sdk": "activity.list", "cli": "activity list", "mcp": { "exposure": "forbidden", "reason": "Cross-domain activity can reveal sensitive operational context and remains forbidden in every MCP profile." } },
    { "operationId": "listComments", "method": "GET", "path": "/comments", "scope": "comments:read", "sdk": "comments.list", "cli": "comments list", "mcp": { "exposure": "forbidden", "reason": "Free-form user comments remain forbidden in every MCP profile." } },
    { "operationId": "createComment", "method": "POST", "path": "/comments", "scope": "comments:write", "sdk": "comments.create", "cli": "comments create", "mcp": { "exposure": "forbidden", "reason": "Writing user-visible comments is forbidden in every MCP profile." } },
    { "operationId": "getComment", "method": "GET", "path": "/comments/{id}", "scope": "comments:read", "sdk": "comments.get", "cli": "comments get", "mcp": { "exposure": "forbidden", "reason": "Free-form user comments remain forbidden in every MCP profile." } },
    { "operationId": "archiveComment", "method": "DELETE", "path": "/comments/{id}", "scope": "comments:write", "sdk": "comments.archive", "cli": "comments archive", "mcp": { "exposure": "forbidden", "reason": "Destructive comment lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "restoreComment", "method": "POST", "path": "/comments/{id}/restore", "scope": "comments:write", "sdk": "comments.restore", "cli": "comments restore", "mcp": { "exposure": "forbidden", "reason": "Comment lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "listDocuments", "method": "GET", "path": "/documents", "scope": "documents:read", "sdk": "documents.list", "cli": "documents list", "mcp": { "exposure": "forbidden", "reason": "User-authored document content remains forbidden in every MCP profile." } },
    { "operationId": "createDocument", "method": "POST", "path": "/documents", "scope": "documents:write", "sdk": "documents.create", "cli": "documents create", "mcp": { "exposure": "forbidden", "reason": "Document writes remain forbidden in every MCP profile." } },
    { "operationId": "getDocument", "method": "GET", "path": "/documents/{id}", "scope": "documents:read", "sdk": "documents.get", "cli": "documents get", "mcp": { "exposure": "forbidden", "reason": "User-authored document content remains forbidden in every MCP profile." } },
    { "operationId": "updateDocument", "method": "PATCH", "path": "/documents/{id}", "scope": "documents:write", "sdk": "documents.update", "cli": "documents update", "mcp": { "exposure": "forbidden", "reason": "Document writes remain forbidden in every MCP profile." } },
    { "operationId": "archiveDocument", "method": "DELETE", "path": "/documents/{id}", "scope": "documents:write", "sdk": "documents.archive", "cli": "documents archive", "mcp": { "exposure": "forbidden", "reason": "Destructive document lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "restoreDocument", "method": "POST", "path": "/documents/{id}/restore", "scope": "documents:write", "sdk": "documents.restore", "cli": "documents restore", "mcp": { "exposure": "forbidden", "reason": "Document lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "listFiles", "method": "GET", "path": "/files", "scope": "files:read", "sdk": "files.list", "cli": "files list", "mcp": { "exposure": "forbidden", "reason": "File metadata and links remain forbidden in every MCP profile." } },
    { "operationId": "getFile", "method": "GET", "path": "/files/{id}", "scope": "files:read", "sdk": "files.get", "cli": "files get", "mcp": { "exposure": "forbidden", "reason": "File metadata and links remain forbidden in every MCP profile." } },
    { "operationId": "renameFile", "method": "PATCH", "path": "/files/{id}", "scope": "files:write", "sdk": "files.rename", "cli": "files rename", "mcp": { "exposure": "forbidden", "reason": "File metadata writes remain forbidden in every MCP profile." } },
    { "operationId": "archiveFile", "method": "DELETE", "path": "/files/{id}", "scope": "files:write", "sdk": "files.archive", "cli": "files archive", "mcp": { "exposure": "forbidden", "reason": "Destructive file lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "restoreFile", "method": "POST", "path": "/files/{id}/restore", "scope": "files:write", "sdk": "files.restore", "cli": "files restore", "mcp": { "exposure": "forbidden", "reason": "File lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "createFileDownloadIntent", "method": "POST", "path": "/files/{id}/download-intent", "scope": "files:read", "sdk": "files.createDownloadIntent", "cli": "files download-intent", "mcp": { "exposure": "forbidden", "reason": "Signed transfer URLs must never enter an AI transcript." } },
    { "operationId": "createFileUploadIntent", "method": "POST", "path": "/file-upload-intents", "scope": "files:write", "sdk": "fileUploadIntents.create", "cli": "file-upload-intents create", "mcp": { "exposure": "forbidden", "reason": "Signed transfer URLs and file uploads are forbidden in every MCP profile." } },
    { "operationId": "finalizeFileUploadIntent", "method": "POST", "path": "/file-upload-intents/{id}/finalize", "scope": "files:write", "sdk": "fileUploadIntents.finalize", "cli": "file-upload-intents finalize", "mcp": { "exposure": "forbidden", "reason": "File upload finalization is forbidden in every MCP profile." } },
    { "operationId": "cancelFileUploadIntent", "method": "DELETE", "path": "/file-upload-intents/{id}", "scope": "files:write", "sdk": "fileUploadIntents.cancel", "cli": "file-upload-intents cancel", "mcp": { "exposure": "forbidden", "reason": "File upload lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "listProducts", "method": "GET", "path": "/products", "scope": "products:read", "sdk": "products.list", "cli": "products list", "mcp": { "exposure": "read", "tool": "teamgrid_products_list", "curated": true, "sensitive": true } },
    { "operationId": "createProduct", "method": "POST", "path": "/products", "scope": "products:write", "sdk": "products.create", "cli": "products create", "mcp": { "exposure": "forbidden", "reason": "Commerce catalog writes remain disabled in every MCP profile." } },
    { "operationId": "getProduct", "method": "GET", "path": "/products/{id}", "scope": "products:read", "sdk": "products.get", "cli": "products get", "mcp": { "exposure": "read", "tool": "teamgrid_product_get", "curated": true, "sensitive": true } },
    { "operationId": "updateProduct", "method": "PATCH", "path": "/products/{id}", "scope": "products:write", "sdk": "products.update", "cli": "products update", "mcp": { "exposure": "forbidden", "reason": "Commerce catalog writes remain disabled in every MCP profile." } },
    { "operationId": "archiveProduct", "method": "DELETE", "path": "/products/{id}", "scope": "products:write", "sdk": "products.archive", "cli": "products archive", "mcp": { "exposure": "forbidden", "reason": "Destructive commerce lifecycle operations are not exposed to MCP." } },
    { "operationId": "listProductGroups", "method": "GET", "path": "/product-groups", "scope": "product-groups:read", "sdk": "productGroups.list", "cli": "product-groups list", "mcp": { "exposure": "read", "tool": "teamgrid_product_groups_list", "curated": true } },
    { "operationId": "createProductGroup", "method": "POST", "path": "/product-groups", "scope": "product-groups:write", "sdk": "productGroups.create", "cli": "product-groups create", "mcp": { "exposure": "forbidden", "reason": "Commerce catalog writes remain disabled in every MCP profile." } },
    { "operationId": "getProductGroup", "method": "GET", "path": "/product-groups/{id}", "scope": "product-groups:read", "sdk": "productGroups.get", "cli": "product-groups get", "mcp": { "exposure": "read", "tool": "teamgrid_product_group_get", "curated": true } },
    { "operationId": "updateProductGroup", "method": "PATCH", "path": "/product-groups/{id}", "scope": "product-groups:write", "sdk": "productGroups.update", "cli": "product-groups update", "mcp": { "exposure": "forbidden", "reason": "Commerce catalog writes remain disabled in every MCP profile." } },
    { "operationId": "archiveProductGroup", "method": "DELETE", "path": "/product-groups/{id}", "scope": "product-groups:write", "sdk": "productGroups.archive", "cli": "product-groups archive", "mcp": { "exposure": "forbidden", "reason": "Destructive commerce lifecycle operations are not exposed to MCP." } },
    { "operationId": "listProjects", "method": "GET", "path": "/projects", "scope": "projects:read", "sdk": "projects.list", "cli": "projects list", "mcp": { "exposure": "read", "tool": "teamgrid_projects_list" } },
    { "operationId": "createProject", "method": "POST", "path": "/projects", "scope": "projects:write", "sdk": "projects.create", "cli": "projects create", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "getProject", "method": "GET", "path": "/projects/{id}", "scope": "projects:read", "sdk": "projects.get", "cli": "projects get", "mcp": { "exposure": "read", "tool": "teamgrid_project_get" } },
    { "operationId": "updateProject", "method": "PATCH", "path": "/projects/{id}", "scope": "projects:write", "sdk": "projects.update", "cli": "projects update", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "getProjectSharing", "method": "GET", "path": "/projects/{id}/sharing", "scope": "projects:sharing", "sdk": "projects.getSharing", "cli": "projects sharing get", "mcp": { "exposure": "forbidden", "reason": "Project access-control metadata is forbidden in every MCP profile." } },
    { "operationId": "replaceProjectSharing", "method": "PUT", "path": "/projects/{id}/sharing", "scope": "projects:sharing", "sdk": "projects.replaceSharing", "cli": "projects sharing replace", "mcp": { "exposure": "forbidden", "reason": "Access-control writes are forbidden in every MCP profile." } },
    { "operationId": "completeProject", "method": "POST", "path": "/projects/{id}/complete", "scope": "projects:lifecycle", "sdk": "projects.complete", "cli": "projects complete", "mcp": { "exposure": "forbidden", "reason": "Cascading project lifecycle operations are not exposed to MCP." } },
    { "operationId": "reopenProject", "method": "POST", "path": "/projects/{id}/reopen", "scope": "projects:lifecycle", "sdk": "projects.reopen", "cli": "projects reopen", "mcp": { "exposure": "forbidden", "reason": "Cascading project lifecycle operations are not exposed to MCP." } },
    { "operationId": "archiveProject", "method": "POST", "path": "/projects/{id}/archive", "scope": "projects:lifecycle", "sdk": "projects.archive", "cli": "projects archive", "mcp": { "exposure": "forbidden", "reason": "Destructive cascading project lifecycle operations are not exposed to MCP." } },
    { "operationId": "restoreProject", "method": "POST", "path": "/projects/{id}/restore", "scope": "projects:lifecycle", "sdk": "projects.restore", "cli": "projects restore", "mcp": { "exposure": "forbidden", "reason": "Cascading project lifecycle operations are not exposed to MCP." } },
    { "operationId": "getProjectLifecycleOperation", "method": "GET", "path": "/project-lifecycle-operations/{id}", "scope": "projects:lifecycle", "sdk": "projectLifecycleOperations.get", "cli": "project-lifecycle-operations get", "mcp": { "exposure": "forbidden", "reason": "Transport-level lifecycle polling state is not exposed to MCP." } },
    { "operationId": "listProjectTemplates", "method": "GET", "path": "/project-templates", "scope": "project-templates:read", "sdk": "projectTemplates.list", "cli": "project-templates list", "mcp": { "exposure": "forbidden", "reason": "Project templates contain workflow structure and are forbidden in every MCP profile." } },
    { "operationId": "createProjectTemplate", "method": "POST", "path": "/project-templates", "scope": "project-templates:write", "sdk": "projectTemplates.create", "cli": "project-templates create", "mcp": { "exposure": "forbidden", "reason": "Capturing project workflow structure is forbidden in every MCP profile." } },
    { "operationId": "getProjectTemplate", "method": "GET", "path": "/project-templates/{id}", "scope": "project-templates:read", "sdk": "projectTemplates.get", "cli": "project-templates get", "mcp": { "exposure": "forbidden", "reason": "Project-template metadata is forbidden in every MCP profile." } },
    { "operationId": "updateProjectTemplate", "method": "PATCH", "path": "/project-templates/{id}", "scope": "project-templates:write", "sdk": "projectTemplates.update", "cli": "project-templates update", "mcp": { "exposure": "forbidden", "reason": "Project-template administration is forbidden in every MCP profile." } },
    { "operationId": "archiveProjectTemplate", "method": "DELETE", "path": "/project-templates/{id}", "scope": "project-templates:write", "sdk": "projectTemplates.archive", "cli": "project-templates archive", "mcp": { "exposure": "forbidden", "reason": "Destructive project-template lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "restoreProjectTemplate", "method": "POST", "path": "/project-templates/{id}/restore", "scope": "project-templates:write", "sdk": "projectTemplates.restore", "cli": "project-templates restore", "mcp": { "exposure": "forbidden", "reason": "Project-template lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "instantiateProjectTemplate", "method": "POST", "path": "/project-templates/{id}/instantiate", "scope": "project-templates:write", "additionalScopes": ["projects:write"], "sdk": "projectTemplates.instantiate", "cli": "project-templates instantiate", "mcp": { "exposure": "forbidden", "reason": "Template instantiation creates a project and many child resources and is forbidden in every MCP profile." } },
    { "operationId": "getProjectTemplateInstantiation", "method": "GET", "path": "/project-template-instantiations/{id}", "scope": "project-templates:write", "additionalScopes": ["projects:write"], "sdk": "projectTemplateInstantiations.get", "cli": "project-template-instantiations get", "mcp": { "exposure": "forbidden", "reason": "Credential-owned bulk workflow execution status is forbidden in every MCP profile." } },
    { "operationId": "listPlannedWork", "method": "GET", "path": "/planned-work", "scope": "planned-work:read", "sdk": "plannedWork.list", "cli": "planned-work list", "mcp": { "exposure": "forbidden", "reason": "Per-user workload and scheduling data is sensitive and conservatively forbidden in every MCP profile." } },
    { "operationId": "getTaskPlannedWork", "method": "GET", "path": "/tasks/{id}/planned-work", "scope": "planned-work:read", "sdk": "plannedWork.getForTask", "cli": "planned-work get", "mcp": { "exposure": "forbidden", "reason": "Per-user workload and scheduling data is sensitive and conservatively forbidden in every MCP profile." } },
    { "operationId": "replaceTaskPlannedWork", "method": "PUT", "path": "/tasks/{id}/planned-work", "scope": "planned-work:write", "sdk": "plannedWork.replaceForTask", "cli": "planned-work replace", "mcp": { "exposure": "forbidden", "reason": "Schedule replacement changes another user's workload and is forbidden in every MCP profile." } },
    { "operationId": "getPlannedWorkOperation", "method": "GET", "path": "/planned-work-operations/{id}", "scope": "planned-work:write", "sdk": "plannedWorkOperations.get", "cli": "planned-work-operations get", "mcp": { "exposure": "forbidden", "reason": "Credential-owned schedule mutation status is forbidden in every MCP profile." } },
    { "operationId": "listProjectStatements", "method": "GET", "path": "/project-statements", "scope": "project-statements:read", "sdk": "projectStatements.list", "cli": "project-statements list", "mcp": { "exposure": "forbidden", "reason": "Project statements contain financial and budget-adjacent data and are forbidden in every MCP profile." } },
    { "operationId": "createProjectStatement", "method": "POST", "path": "/project-statements", "scope": "project-statements:write", "sdk": "projectStatements.create", "cli": "project-statements create", "mcp": { "exposure": "forbidden", "reason": "Financial writes are forbidden in every MCP profile." } },
    { "operationId": "getProjectStatement", "method": "GET", "path": "/project-statements/{id}", "scope": "project-statements:read", "sdk": "projectStatements.get", "cli": "project-statements get", "mcp": { "exposure": "forbidden", "reason": "Project statements contain financial and budget-adjacent data and are forbidden in every MCP profile." } },
    { "operationId": "updateProjectStatement", "method": "PATCH", "path": "/project-statements/{id}", "scope": "project-statements:write", "sdk": "projectStatements.update", "cli": "project-statements update", "mcp": { "exposure": "forbidden", "reason": "Financial writes are forbidden in every MCP profile." } },
    { "operationId": "archiveProjectStatement", "method": "DELETE", "path": "/project-statements/{id}", "scope": "project-statements:write", "sdk": "projectStatements.archive", "cli": "project-statements archive", "mcp": { "exposure": "forbidden", "reason": "Destructive financial lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "restoreProjectStatement", "method": "POST", "path": "/project-statements/{id}/restore", "scope": "project-statements:write", "sdk": "projectStatements.restore", "cli": "project-statements restore", "mcp": { "exposure": "forbidden", "reason": "Financial lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "listTasks", "method": "GET", "path": "/tasks", "scope": "tasks:read", "sdk": "tasks.list", "cli": "tasks list", "mcp": { "exposure": "read", "tool": "teamgrid_tasks_list" } },
    { "operationId": "bulkUpdateTasks", "method": "POST", "path": "/tasks/bulk-update", "scope": "tasks:write", "sdk": "tasks.bulkUpdate", "cli": "tasks bulk-update", "mcp": { "exposure": "forbidden", "reason": "High-impact multi-resource writes are forbidden in every MCP profile." } },
    { "operationId": "createTask", "method": "POST", "path": "/tasks", "scope": "tasks:write", "sdk": "tasks.create", "cli": "tasks create", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "getTask", "method": "GET", "path": "/tasks/{id}", "scope": "tasks:read", "sdk": "tasks.get", "cli": "tasks get", "mcp": { "exposure": "read", "tool": "teamgrid_task_get" } },
    { "operationId": "updateTask", "method": "PATCH", "path": "/tasks/{id}", "scope": "tasks:write", "sdk": "tasks.update", "cli": "tasks update", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "duplicateTask", "method": "POST", "path": "/tasks/{id}/duplicate", "scope": "tasks:read", "additionalScopes": ["tasks:write"], "sdk": "tasks.duplicate", "cli": "tasks duplicate", "mcp": { "exposure": "forbidden", "reason": "Task creation remains disabled in the read-only MCP profile." } },
    { "operationId": "moveTask", "method": "POST", "path": "/tasks/{id}/move", "scope": "tasks:write", "sdk": "tasks.move", "cli": "tasks move", "mcp": { "exposure": "forbidden", "reason": "Ordering and assignment writes remain disabled in the read-only MCP profile." } },
    { "operationId": "replaceTaskSubtasks", "method": "PUT", "path": "/tasks/{id}/subtasks", "scope": "tasks:write", "sdk": "tasks.replaceSubtasks", "cli": "tasks subtasks replace", "mcp": { "exposure": "forbidden", "reason": "Checklist writes remain disabled in the read-only MCP profile." } },
    { "operationId": "archiveTask", "method": "DELETE", "path": "/tasks/{id}", "scope": "tasks:write", "sdk": "tasks.archive", "cli": "tasks archive", "mcp": { "exposure": "forbidden", "reason": "Destructive lifecycle operations are not exposed to MCP." } },
    { "operationId": "restoreTask", "method": "POST", "path": "/tasks/{id}/restore", "scope": "tasks:write", "sdk": "tasks.restore", "cli": "tasks restore", "mcp": { "exposure": "forbidden", "reason": "Lifecycle writes remain disabled in the default MCP profile." } },
    { "operationId": "completeTask", "method": "POST", "path": "/tasks/{id}/complete", "scope": "tasks:write", "sdk": "tasks.complete", "cli": "tasks complete", "mcp": { "exposure": "forbidden", "reason": "Lifecycle writes remain disabled in the default MCP profile." } },
    { "operationId": "reopenTask", "method": "POST", "path": "/tasks/{id}/reopen", "scope": "tasks:write", "sdk": "tasks.reopen", "cli": "tasks reopen", "mcp": { "exposure": "forbidden", "reason": "Lifecycle writes remain disabled in the default MCP profile." } },
    { "operationId": "startTaskTimer", "method": "POST", "path": "/tasks/{id}/timer/start", "scope": "tasks:write", "additionalScopes": ["time-entries:write"], "sdk": "tasks.startTimer", "cli": "tasks timer start", "mcp": { "exposure": "forbidden", "reason": "Time tracking writes on behalf of users remain disabled for MCP." } },
    { "operationId": "stopTaskTimer", "method": "POST", "path": "/tasks/{id}/timer/stop", "scope": "tasks:write", "additionalScopes": ["time-entries:write"], "sdk": "tasks.stopTimer", "cli": "tasks timer stop", "mcp": { "exposure": "forbidden", "reason": "Time tracking writes on behalf of users remain disabled for MCP." } },
    { "operationId": "listTimeEntries", "method": "GET", "path": "/time-entries", "scope": "time-entries:read", "sdk": "timeEntries.list", "cli": "time-entries list", "mcp": { "exposure": "read", "tool": "teamgrid_time_entries_list" } },
    { "operationId": "createTimeEntry", "method": "POST", "path": "/time-entries", "scope": "time-entries:write", "sdk": "timeEntries.create", "cli": "time-entries create", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "getTimeEntry", "method": "GET", "path": "/time-entries/{id}", "scope": "time-entries:read", "sdk": "timeEntries.get", "cli": "time-entries get", "mcp": { "exposure": "read", "tool": "teamgrid_time_entry_get" } },
    { "operationId": "getTimeEntryBilling", "method": "GET", "path": "/time-entries/{id}/billing", "scope": "time-entries:billing", "sdk": "timeEntries.getBilling", "cli": "time-entries billing get", "mcp": { "exposure": "forbidden", "reason": "Billing decisions and lock state are finance-sensitive and forbidden in every MCP profile." } },
    { "operationId": "updateTimeEntry", "method": "PATCH", "path": "/time-entries/{id}", "scope": "time-entries:write", "sdk": "timeEntries.update", "cli": "time-entries update", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "updateTimeEntryBilling", "method": "PUT", "path": "/time-entries/{id}/billing", "scope": "time-entries:billing", "sdk": "timeEntries.updateBilling", "cli": "time-entries billing update", "mcp": { "exposure": "forbidden", "reason": "Billing decisions are privileged writes and forbidden in every MCP profile." } },
    { "operationId": "archiveTimeEntry", "method": "DELETE", "path": "/time-entries/{id}", "scope": "time-entries:write", "sdk": "timeEntries.archive", "cli": "time-entries archive", "mcp": { "exposure": "forbidden", "reason": "Destructive lifecycle operations are not exposed to MCP." } },
    { "operationId": "restoreTimeEntry", "method": "POST", "path": "/time-entries/{id}/restore", "scope": "time-entries:write", "sdk": "timeEntries.restore", "cli": "time-entries restore", "mcp": { "exposure": "forbidden", "reason": "Lifecycle writes remain disabled in the default MCP profile." } },
    { "operationId": "listCallNotes", "method": "GET", "path": "/call-notes", "scope": "call-notes:read", "sdk": "callNotes.list", "cli": "call-notes list", "mcp": { "exposure": "read", "tool": "teamgrid_call_notes_list", "sensitive": true } },
    { "operationId": "createCallNote", "method": "POST", "path": "/call-notes", "scope": "call-notes:write", "sdk": "callNotes.create", "cli": "call-notes create", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in every MCP profile." } },
    { "operationId": "getCallNote", "method": "GET", "path": "/call-notes/{id}", "scope": "call-notes:read", "sdk": "callNotes.get", "cli": "call-notes get", "mcp": { "exposure": "read", "tool": "teamgrid_call_note_get", "sensitive": true } },
    { "operationId": "archiveCallNote", "method": "DELETE", "path": "/call-notes/{id}", "scope": "call-notes:write", "sdk": "callNotes.archive", "cli": "call-notes archive", "mcp": { "exposure": "forbidden", "reason": "Destructive lifecycle operations are not exposed to MCP." } },
    { "operationId": "restoreCallNote", "method": "POST", "path": "/call-notes/{id}/restore", "scope": "call-notes:write", "sdk": "callNotes.restore", "cli": "call-notes restore", "mcp": { "exposure": "forbidden", "reason": "Lifecycle writes remain disabled in every MCP profile." } },
    { "operationId": "listContactGroups", "method": "GET", "path": "/contact-groups", "scope": "contact-groups:read", "sdk": "contactGroups.list", "cli": "contact-groups list", "mcp": { "exposure": "read", "tool": "teamgrid_contact_groups_list" } },
    { "operationId": "createContactGroup", "method": "POST", "path": "/contact-groups", "scope": "contact-groups:write", "sdk": "contactGroups.create", "cli": "contact-groups create", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in every MCP profile." } },
    { "operationId": "getContactGroup", "method": "GET", "path": "/contact-groups/{id}", "scope": "contact-groups:read", "sdk": "contactGroups.get", "cli": "contact-groups get", "mcp": { "exposure": "read", "tool": "teamgrid_contact_group_get" } },
    { "operationId": "updateContactGroup", "method": "PATCH", "path": "/contact-groups/{id}", "scope": "contact-groups:write", "sdk": "contactGroups.update", "cli": "contact-groups update", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in every MCP profile." } },
    { "operationId": "archiveContactGroup", "method": "DELETE", "path": "/contact-groups/{id}", "scope": "contact-groups:write", "sdk": "contactGroups.archive", "cli": "contact-groups archive", "mcp": { "exposure": "forbidden", "reason": "Destructive lifecycle operations are not exposed to MCP." } },
    { "operationId": "restoreContactGroup", "method": "POST", "path": "/contact-groups/{id}/restore", "scope": "contact-groups:write", "sdk": "contactGroups.restore", "cli": "contact-groups restore", "mcp": { "exposure": "forbidden", "reason": "Lifecycle writes remain disabled in every MCP profile." } },
    { "operationId": "listContacts", "method": "GET", "path": "/contacts", "scope": "contacts:read", "sdk": "contacts.list", "cli": "contacts list", "mcp": { "exposure": "read", "tool": "teamgrid_contacts_list" } },
    { "operationId": "createContact", "method": "POST", "path": "/contacts", "scope": "contacts:write", "sdk": "contacts.create", "cli": "contacts create", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "getContact", "method": "GET", "path": "/contacts/{id}", "scope": "contacts:read", "sdk": "contacts.get", "cli": "contacts get", "mcp": { "exposure": "read", "tool": "teamgrid_contact_get" } },
    { "operationId": "updateContact", "method": "PATCH", "path": "/contacts/{id}", "scope": "contacts:write", "sdk": "contacts.update", "cli": "contacts update", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "listUsers", "method": "GET", "path": "/users", "scope": "users:read", "sdk": "users.list", "cli": "users", "mcp": { "exposure": "read", "tool": "teamgrid_users_list" } },
    { "operationId": "listLists", "method": "GET", "path": "/lists", "scope": "lists:read", "sdk": "lists.list", "cli": "lists list", "mcp": { "exposure": "read", "tool": "teamgrid_lists_list" } },
    { "operationId": "createList", "method": "POST", "path": "/lists", "scope": "lists:write", "sdk": "lists.create", "cli": "lists create", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "getList", "method": "GET", "path": "/lists/{id}", "scope": "lists:read", "sdk": "lists.get", "cli": "lists get", "mcp": { "exposure": "read", "tool": "teamgrid_list_get" } },
    { "operationId": "updateList", "method": "PATCH", "path": "/lists/{id}", "scope": "lists:write", "sdk": "lists.update", "cli": "lists update", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "archiveList", "method": "DELETE", "path": "/lists/{id}", "scope": "lists:write", "sdk": "lists.archive", "cli": "lists archive", "mcp": { "exposure": "forbidden", "reason": "Destructive lifecycle operations are not exposed to MCP." } },
    { "operationId": "restoreList", "method": "POST", "path": "/lists/{id}/restore", "scope": "lists:write", "sdk": "lists.restore", "cli": "lists restore", "mcp": { "exposure": "forbidden", "reason": "Lifecycle writes remain disabled in the default MCP profile." } },
    { "operationId": "listServices", "method": "GET", "path": "/services", "scope": "services:read", "sdk": "services.list", "cli": "services list", "mcp": { "exposure": "read", "tool": "teamgrid_services_list", "sensitive": true } },
    { "operationId": "createService", "method": "POST", "path": "/services", "scope": "services:write", "sdk": "services.create", "cli": "services create", "mcp": { "exposure": "forbidden", "reason": "Writes and billing rates remain disabled for MCP." } },
    { "operationId": "getService", "method": "GET", "path": "/services/{id}", "scope": "services:read", "sdk": "services.get", "cli": "services get", "mcp": { "exposure": "read", "tool": "teamgrid_service_get", "sensitive": true } },
    { "operationId": "updateService", "method": "PATCH", "path": "/services/{id}", "scope": "services:write", "sdk": "services.update", "cli": "services update", "mcp": { "exposure": "forbidden", "reason": "Writes and billing rates remain disabled for MCP." } },
    { "operationId": "archiveService", "method": "DELETE", "path": "/services/{id}", "scope": "services:write", "sdk": "services.archive", "cli": "services archive", "mcp": { "exposure": "forbidden", "reason": "Destructive lifecycle operations are not exposed to MCP." } },
    { "operationId": "restoreService", "method": "POST", "path": "/services/{id}/restore", "scope": "services:write", "sdk": "services.restore", "cli": "services restore", "mcp": { "exposure": "forbidden", "reason": "Lifecycle writes remain disabled in the default MCP profile." } },
    { "operationId": "listTags", "method": "GET", "path": "/tags", "scope": "tags:read", "sdk": "tags.list", "cli": "tags list", "mcp": { "exposure": "read", "tool": "teamgrid_tags_list" } },
    { "operationId": "createTag", "method": "POST", "path": "/tags", "scope": "tags:write", "sdk": "tags.create", "cli": "tags create", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "getTag", "method": "GET", "path": "/tags/{id}", "scope": "tags:read", "sdk": "tags.get", "cli": "tags get", "mcp": { "exposure": "read", "tool": "teamgrid_tag_get" } },
    { "operationId": "updateTag", "method": "PATCH", "path": "/tags/{id}", "scope": "tags:write", "sdk": "tags.update", "cli": "tags update", "mcp": { "exposure": "forbidden", "reason": "Writes remain disabled in the default MCP profile." } },
    { "operationId": "archiveTag", "method": "DELETE", "path": "/tags/{id}", "scope": "tags:write", "sdk": "tags.archive", "cli": "tags archive", "mcp": { "exposure": "forbidden", "reason": "Destructive lifecycle operations are not exposed to MCP." } },
    { "operationId": "restoreTag", "method": "POST", "path": "/tags/{id}/restore", "scope": "tags:write", "sdk": "tags.restore", "cli": "tags restore", "mcp": { "exposure": "forbidden", "reason": "Lifecycle writes remain disabled in the default MCP profile." } },
    { "operationId": "listCustomFieldDefinitions", "method": "GET", "path": "/custom-field-definitions", "scope": "custom-field-definitions:read", "sdk": "customFieldDefinitions.list", "cli": "custom-field-definitions list", "mcp": { "exposure": "read", "tool": "teamgrid_custom_field_definitions_list" } },
    { "operationId": "createCustomFieldDefinition", "method": "POST", "path": "/custom-field-definitions", "scope": "custom-field-definitions:write", "sdk": "customFieldDefinitions.create", "cli": "custom-field-definitions create", "mcp": { "exposure": "forbidden", "reason": "Administrative schema writes remain disabled for MCP." } },
    { "operationId": "getCustomFieldDefinition", "method": "GET", "path": "/custom-field-definitions/{id}", "scope": "custom-field-definitions:read", "sdk": "customFieldDefinitions.get", "cli": "custom-field-definitions get", "mcp": { "exposure": "read", "tool": "teamgrid_custom_field_definition_get" } },
    { "operationId": "updateCustomFieldDefinition", "method": "PATCH", "path": "/custom-field-definitions/{id}", "scope": "custom-field-definitions:write", "sdk": "customFieldDefinitions.update", "cli": "custom-field-definitions update", "mcp": { "exposure": "forbidden", "reason": "Administrative schema writes remain disabled for MCP." } },
    { "operationId": "archiveCustomFieldDefinition", "method": "DELETE", "path": "/custom-field-definitions/{id}", "scope": "custom-field-definitions:write", "sdk": "customFieldDefinitions.archive", "cli": "custom-field-definitions archive", "mcp": { "exposure": "forbidden", "reason": "Destructive administrative schema operations are not exposed to MCP." } },
    { "operationId": "restoreCustomFieldDefinition", "method": "POST", "path": "/custom-field-definitions/{id}/restore", "scope": "custom-field-definitions:write", "sdk": "customFieldDefinitions.restore", "cli": "custom-field-definitions restore", "mcp": { "exposure": "forbidden", "reason": "Administrative lifecycle writes remain disabled for MCP." } },
    { "operationId": "getCustomFieldValues", "method": "POST", "path": "/custom-field-values/{targetType}/{resourceId}/batch-read", "scope": "custom-field-values:read", "sdk": "customFieldValues.getMany", "cli": "custom-field-values get-many", "mcp": { "exposure": "forbidden", "reason": "Per-resource custom-field data is sensitive and forbidden in every MCP profile." } },
    { "operationId": "getCustomFieldValue", "method": "GET", "path": "/custom-field-values/{targetType}/{resourceId}/{fieldId}", "scope": "custom-field-values:read", "sdk": "customFieldValues.get", "cli": "custom-field-values get", "mcp": { "exposure": "forbidden", "reason": "Per-resource custom-field data is sensitive and forbidden in every MCP profile." } },
    { "operationId": "setCustomFieldValue", "method": "PUT", "path": "/custom-field-values/{targetType}/{resourceId}/{fieldId}", "scope": "custom-field-values:write", "sdk": "customFieldValues.set", "cli": "custom-field-values set", "mcp": { "exposure": "forbidden", "reason": "Compare-and-set custom-field writes are forbidden in every MCP profile." } },
    { "operationId": "clearCustomFieldValue", "method": "DELETE", "path": "/custom-field-values/{targetType}/{resourceId}/{fieldId}", "scope": "custom-field-values:write", "sdk": "customFieldValues.clear", "cli": "custom-field-values clear", "mcp": { "exposure": "forbidden", "reason": "Compare-and-set custom-field writes are forbidden in every MCP profile." } },
    { "operationId": "listAuditEvents", "method": "GET", "path": "/audit-events", "scope": "audit:read", "sdk": "auditEvents.list", "cli": "audit-events", "mcp": { "exposure": "forbidden", "reason": "Sensitive governance and administrative audit metadata is not suitable for model transcripts." } },
    { "operationId": "listWebhookDeliveries", "method": "GET", "path": "/webhook-deliveries", "scope": "webhooks:read", "sdk": "webhookDeliveries.list", "cli": "webhook-deliveries list", "mcp": { "exposure": "forbidden", "reason": "Webhook delivery metadata contains sensitive operational information and is forbidden in every MCP profile." } },
    { "operationId": "getWebhookDelivery", "method": "GET", "path": "/webhook-deliveries/{id}", "scope": "webhooks:read", "sdk": "webhookDeliveries.get", "cli": "webhook-deliveries get", "mcp": { "exposure": "forbidden", "reason": "Webhook delivery metadata contains sensitive operational information and is forbidden in every MCP profile." } },
    { "operationId": "listWebhooks", "method": "GET", "path": "/webhooks", "scope": "webhooks:read", "sdk": "webhooks.list", "cli": "webhooks list", "mcp": { "exposure": "read", "tool": "teamgrid_webhooks_list" } },
    { "operationId": "createWebhook", "method": "POST", "path": "/webhooks", "scope": "webhooks:write", "sdk": "webhooks.create", "cli": "webhooks create", "mcp": { "exposure": "forbidden", "reason": "The reveal-once signing secret must never enter an AI transcript." } },
    { "operationId": "getWebhook", "method": "GET", "path": "/webhooks/{id}", "scope": "webhooks:read", "sdk": "webhooks.get", "cli": "webhooks get", "mcp": { "exposure": "read", "tool": "teamgrid_webhook_get" } },
    { "operationId": "updateWebhook", "method": "PATCH", "path": "/webhooks/{id}", "scope": "webhooks:write", "sdk": "webhooks.update", "cli": "webhooks update", "mcp": { "exposure": "forbidden", "reason": "Webhook configuration writes are not exposed to MCP." } },
    { "operationId": "rotateWebhookSecret", "method": "POST", "path": "/webhooks/{id}/secret-rotation", "scope": "webhooks:write", "sdk": "webhooks.rotateSecret", "cli": "webhooks rotate-secret", "mcp": { "exposure": "forbidden", "reason": "Reveal-only signing secrets must never enter an AI transcript." } },
    { "operationId": "testWebhookDelivery", "method": "POST", "path": "/webhooks/{id}/test-delivery", "scope": "webhooks:write", "sdk": "webhooks.testDelivery", "cli": "webhooks test", "mcp": { "exposure": "forbidden", "reason": "Network side effects and delivery metadata remain outside every MCP profile." } },
    { "operationId": "removeWebhook", "method": "DELETE", "path": "/webhooks/{id}", "scope": "webhooks:write", "sdk": "webhooks.remove", "cli": "webhooks remove", "mcp": { "exposure": "forbidden", "reason": "Destructive lifecycle operations are not exposed to MCP." } },
    { "operationId": "listMembers", "method": "GET", "path": "/members", "scope": "members:read", "sdk": "members.list", "cli": "members list", "mcp": { "exposure": "forbidden", "reason": "Workspace membership and optional PII remain outside every MCP profile." } },
    { "operationId": "getMember", "method": "GET", "path": "/members/{id}", "scope": "members:read", "sdk": "members.get", "cli": "members get", "mcp": { "exposure": "forbidden", "reason": "Workspace membership and optional PII remain outside every MCP profile." } },
    { "operationId": "updateMemberRole", "method": "PATCH", "path": "/members/{id}/role", "scope": "members:write", "sdk": "members.updateRole", "cli": "members update-role", "mcp": { "exposure": "forbidden", "reason": "Member administration is forbidden in every MCP profile." } },
    { "operationId": "removeMember", "method": "DELETE", "path": "/members/{id}", "scope": "members:write", "sdk": "members.remove", "cli": "members remove", "mcp": { "exposure": "forbidden", "reason": "Destructive member administration is forbidden in every MCP profile." } },
    { "operationId": "listInvitations", "method": "GET", "path": "/invitations", "scope": "invitations:read", "sdk": "invitations.list", "cli": "invitations list", "mcp": { "exposure": "forbidden", "reason": "Pending invitations and optional email addresses remain outside every MCP profile." } },
    { "operationId": "createInvitation", "method": "POST", "path": "/invitations", "scope": "invitations:write", "sdk": "invitations.create", "cli": "invitations create", "mcp": { "exposure": "forbidden", "reason": "Invitation administration is forbidden in every MCP profile." } },
    { "operationId": "getInvitation", "method": "GET", "path": "/invitations/{id}", "scope": "invitations:read", "sdk": "invitations.get", "cli": "invitations get", "mcp": { "exposure": "forbidden", "reason": "Pending invitations and optional email addresses remain outside every MCP profile." } },
    { "operationId": "cancelInvitation", "method": "DELETE", "path": "/invitations/{id}", "scope": "invitations:write", "sdk": "invitations.cancel", "cli": "invitations cancel", "mcp": { "exposure": "forbidden", "reason": "Invitation administration is forbidden in every MCP profile." } },
    { "operationId": "resendInvitation", "method": "POST", "path": "/invitations/{id}/resend", "scope": "invitations:write", "sdk": "invitations.resend", "cli": "invitations resend", "mcp": { "exposure": "forbidden", "reason": "Invitation delivery is forbidden in every MCP profile." } },
    { "operationId": "listRoles", "method": "GET", "path": "/roles", "scope": "roles:read", "sdk": "roles.list", "cli": "roles list", "mcp": { "exposure": "forbidden", "reason": "Workspace authorization structure remains outside every MCP profile." } },
    { "operationId": "createRole", "method": "POST", "path": "/roles", "scope": "roles:write", "sdk": "roles.create", "cli": "roles create", "mcp": { "exposure": "forbidden", "reason": "Role administration is forbidden in every MCP profile." } },
    { "operationId": "getRole", "method": "GET", "path": "/roles/{id}", "scope": "roles:read", "sdk": "roles.get", "cli": "roles get", "mcp": { "exposure": "forbidden", "reason": "Workspace authorization structure remains outside every MCP profile." } },
    { "operationId": "updateRole", "method": "PATCH", "path": "/roles/{id}", "scope": "roles:write", "sdk": "roles.update", "cli": "roles update", "mcp": { "exposure": "forbidden", "reason": "Role administration is forbidden in every MCP profile." } },
    { "operationId": "deleteRole", "method": "DELETE", "path": "/roles/{id}", "scope": "roles:write", "sdk": "roles.remove", "cli": "roles remove", "mcp": { "exposure": "forbidden", "reason": "Destructive role administration is forbidden in every MCP profile." } },
    { "operationId": "listGroups", "method": "GET", "path": "/groups", "scope": "groups:read", "sdk": "groups.list", "cli": "groups list", "mcp": { "exposure": "forbidden", "reason": "Workspace group membership remains outside every MCP profile." } },
    { "operationId": "createGroup", "method": "POST", "path": "/groups", "scope": "groups:write", "sdk": "groups.create", "cli": "groups create", "mcp": { "exposure": "forbidden", "reason": "Group administration is forbidden in every MCP profile." } },
    { "operationId": "getGroup", "method": "GET", "path": "/groups/{id}", "scope": "groups:read", "sdk": "groups.get", "cli": "groups get", "mcp": { "exposure": "forbidden", "reason": "Workspace group membership remains outside every MCP profile." } },
    { "operationId": "updateGroup", "method": "PATCH", "path": "/groups/{id}", "scope": "groups:write", "sdk": "groups.update", "cli": "groups update", "mcp": { "exposure": "forbidden", "reason": "Group administration is forbidden in every MCP profile." } },
    { "operationId": "deleteGroup", "method": "DELETE", "path": "/groups/{id}", "scope": "groups:write", "sdk": "groups.remove", "cli": "groups remove", "mcp": { "exposure": "forbidden", "reason": "Destructive group administration is forbidden in every MCP profile." } },
    { "operationId": "searchResources", "method": "POST", "path": "/search", "scope": "search:read", "sdk": "search.query", "cli": "search query", "mcp": { "exposure": "read", "tool": "teamgrid_search", "curated": true, "sensitive": true } },
    { "operationId": "createExport", "method": "POST", "path": "/exports", "scope": "exports:write", "sdk": "exports.create", "cli": "exports create", "mcp": { "exposure": "forbidden", "reason": "Broad asynchronous data exports are forbidden in every MCP profile." } },
    { "operationId": "getExport", "method": "GET", "path": "/exports/{id}", "scope": "exports:read", "sdk": "exports.get", "cli": "exports get", "mcp": { "exposure": "forbidden", "reason": "Export job and download metadata are forbidden in every MCP profile." } },
    { "operationId": "createExportDownloadIntent", "method": "POST", "path": "/exports/{id}/download-intent", "scope": "exports:read", "sdk": "exports.createDownloadIntent", "cli": "exports download-intent", "mcp": { "exposure": "forbidden", "reason": "Export download capabilities must never enter an AI transcript." } },
    { "operationId": "downloadExport", "method": "GET", "path": "/exports/{id}/download", "scope": "exports:read", "sdk": "exports.download", "cli": "exports download", "mcp": { "exposure": "forbidden", "reason": "Bulk export content is forbidden in every MCP profile." } },
    { "operationId": "listAutomationActions", "method": "GET", "path": "/automation-actions", "scope": "automations:read", "sdk": "automationActions.list", "cli": "automation-actions list", "mcp": { "exposure": "forbidden", "reason": "The automation DSL catalog remains outside every MCP profile." } },
    { "operationId": "listAutomationDefinitions", "method": "GET", "path": "/automation-definitions", "scope": "automations:read", "sdk": "automationDefinitions.list", "cli": "automation-definitions list", "mcp": { "exposure": "forbidden", "reason": "Automation workflow structure remains outside every MCP profile." } },
    { "operationId": "createAutomationDefinition", "method": "POST", "path": "/automation-definitions", "scope": "automations:write", "sdk": "automationDefinitions.create", "cli": "automation-definitions create", "mcp": { "exposure": "forbidden", "reason": "Automation writes are forbidden in every MCP profile." } },
    { "operationId": "getAutomationDefinition", "method": "GET", "path": "/automation-definitions/{id}", "scope": "automations:read", "sdk": "automationDefinitions.get", "cli": "automation-definitions get", "mcp": { "exposure": "forbidden", "reason": "Automation workflow structure remains outside every MCP profile." } },
    { "operationId": "updateAutomationDefinition", "method": "PATCH", "path": "/automation-definitions/{id}", "scope": "automations:write", "sdk": "automationDefinitions.update", "cli": "automation-definitions update", "mcp": { "exposure": "forbidden", "reason": "Automation writes are forbidden in every MCP profile." } },
    { "operationId": "archiveAutomationDefinition", "method": "DELETE", "path": "/automation-definitions/{id}", "scope": "automations:write", "sdk": "automationDefinitions.archive", "cli": "automation-definitions archive", "mcp": { "exposure": "forbidden", "reason": "Destructive automation lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "restoreAutomationDefinition", "method": "POST", "path": "/automation-definitions/{id}/restore", "scope": "automations:write", "sdk": "automationDefinitions.restore", "cli": "automation-definitions restore", "mcp": { "exposure": "forbidden", "reason": "Automation lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "listAutomationDefinitionVersions", "method": "GET", "path": "/automation-definitions/{id}/versions", "scope": "automations:read", "sdk": "automationDefinitionVersions.list", "cli": "automation-definition-versions list", "mcp": { "exposure": "forbidden", "reason": "Historical automation workflow structure remains outside every MCP profile." } },
    { "operationId": "listAutomationRuns", "method": "GET", "path": "/automation-runs", "scope": "automations:read", "sdk": "automationRuns.list", "cli": "automation-runs list", "mcp": { "exposure": "forbidden", "reason": "Automation execution metadata remains outside every MCP profile." } },
    { "operationId": "getAutomationRun", "method": "GET", "path": "/automation-runs/{id}", "scope": "automations:read", "sdk": "automationRuns.get", "cli": "automation-runs get", "mcp": { "exposure": "forbidden", "reason": "Automation execution metadata remains outside every MCP profile." } },
    { "operationId": "abortAutomationRun", "method": "POST", "path": "/automation-runs/{id}/abort", "scope": "automations:run", "sdk": "automationRuns.abort", "cli": "automation-runs abort", "mcp": { "exposure": "forbidden", "reason": "Automation execution control is forbidden in every MCP profile." } },
    { "operationId": "listIntegrationInstallations", "method": "GET", "path": "/integration-installations", "scope": "integrations:read", "sdk": "integrationInstallations.list", "cli": "integration-installations list", "mcp": { "exposure": "forbidden", "reason": "Workspace integration installation metadata remains outside every MCP profile." } },
    { "operationId": "listTaskRecurrences", "method": "GET", "path": "/task-recurrences", "scope": "task-recurrences:read", "additionalScopes": ["tasks:read"], "sdk": "taskRecurrences.list", "cli": "task-recurrences list", "mcp": { "exposure": "read", "tool": "teamgrid_task_recurrences_list", "curated": true } },
    { "operationId": "createTaskRecurrence", "method": "POST", "path": "/task-recurrences", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.create", "cli": "task-recurrences create", "mcp": { "exposure": "forbidden", "reason": "Creating unattended recurring work is forbidden in every MCP profile." } },
    { "operationId": "previewTaskRecurrence", "method": "POST", "path": "/task-recurrences/preview", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.preview", "cli": "task-recurrences preview", "mcp": { "exposure": "forbidden", "reason": "Draft policy preview accepts complex unpersisted definitions and is forbidden in every MCP profile." } },
    { "operationId": "getTaskRecurrence", "method": "GET", "path": "/task-recurrences/{id}", "scope": "task-recurrences:read", "additionalScopes": ["tasks:read"], "sdk": "taskRecurrences.get", "cli": "task-recurrences get", "mcp": { "exposure": "read", "tool": "teamgrid_task_recurrence_get", "curated": true } },
    { "operationId": "updateTaskRecurrence", "method": "PATCH", "path": "/task-recurrences/{id}", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.update", "cli": "task-recurrences update", "mcp": { "exposure": "forbidden", "reason": "Recurrence policy writes are forbidden in every MCP profile." } },
    { "operationId": "archiveTaskRecurrence", "method": "DELETE", "path": "/task-recurrences/{id}", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.archive", "cli": "task-recurrences archive", "mcp": { "exposure": "forbidden", "reason": "Destructive recurrence lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "previewStoredTaskRecurrence", "method": "GET", "path": "/task-recurrences/{id}/preview", "scope": "task-recurrences:read", "additionalScopes": ["tasks:read"], "sdk": "taskRecurrences.previewStored", "cli": "task-recurrences preview-stored", "mcp": { "exposure": "read", "tool": "teamgrid_task_recurrence_preview", "curated": true } },
    { "operationId": "restoreTaskRecurrence", "method": "POST", "path": "/task-recurrences/{id}/restore", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.restore", "cli": "task-recurrences restore", "mcp": { "exposure": "forbidden", "reason": "Recurrence lifecycle writes are forbidden in every MCP profile." } },
    { "operationId": "pauseTaskRecurrence", "method": "POST", "path": "/task-recurrences/{id}/pause", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.pause", "cli": "task-recurrences pause", "mcp": { "exposure": "forbidden", "reason": "Recurrence lifecycle writes are forbidden in every MCP profile." } },
    { "operationId": "resumeTaskRecurrence", "method": "POST", "path": "/task-recurrences/{id}/resume", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.resume", "cli": "task-recurrences resume", "mcp": { "exposure": "forbidden", "reason": "Resuming automatic task generation is forbidden in every MCP profile." } },
    { "operationId": "endTaskRecurrence", "method": "POST", "path": "/task-recurrences/{id}/end", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.end", "cli": "task-recurrences end", "mcp": { "exposure": "forbidden", "reason": "Destructive recurrence lifecycle operations are forbidden in every MCP profile." } },
    { "operationId": "removeTaskRecurrenceFromTasks", "method": "POST", "path": "/task-recurrences/{id}/remove-from-tasks", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.removeFromTasks", "cli": "task-recurrences remove-from-tasks", "mcp": { "exposure": "forbidden", "reason": "Removing recurrence provenance from tasks is a destructive lifecycle operation and is forbidden in every MCP profile." } },
    { "operationId": "transferTaskRecurrenceOwner", "method": "POST", "path": "/task-recurrences/{id}/owner", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.transferOwner", "cli": "task-recurrences owner", "mcp": { "exposure": "forbidden", "reason": "Principal ownership transfers are forbidden in every MCP profile." } },
    { "operationId": "applyTaskAsTaskRecurrenceTemplate", "method": "POST", "path": "/task-recurrences/{id}/definition-from-task", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.applyTaskTemplate", "cli": "task-recurrences template-from-task", "mcp": { "exposure": "forbidden", "reason": "Recurrence template writes are forbidden in every MCP profile." } },
    { "operationId": "listTaskRecurrenceVersions", "method": "GET", "path": "/task-recurrences/{id}/versions", "scope": "task-recurrences:read", "additionalScopes": ["tasks:read"], "sdk": "taskRecurrenceVersions.list", "cli": "task-recurrences versions list", "mcp": { "exposure": "read", "tool": "teamgrid_task_recurrence_versions_list", "curated": true } },
    { "operationId": "getTaskRecurrenceVersion", "method": "GET", "path": "/task-recurrences/{id}/versions/{versionId}", "scope": "task-recurrences:read", "additionalScopes": ["tasks:read"], "sdk": "taskRecurrenceVersions.get", "cli": "task-recurrences versions get", "mcp": { "exposure": "read", "tool": "teamgrid_task_recurrence_version_get", "curated": true } },
    { "operationId": "restoreTaskRecurrenceVersion", "method": "POST", "path": "/task-recurrences/{id}/versions/{versionId}/restore", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrenceVersions.restore", "cli": "task-recurrences versions restore", "mcp": { "exposure": "forbidden", "reason": "Version restoration changes future task generation and is forbidden in every MCP profile." } },
    { "operationId": "listTaskRecurrenceOccurrences", "method": "GET", "path": "/task-recurrences/{id}/occurrences", "scope": "task-recurrences:read", "additionalScopes": ["tasks:read"], "sdk": "taskRecurrenceOccurrences.list", "cli": "task-recurrences occurrences list", "mcp": { "exposure": "read", "tool": "teamgrid_task_recurrence_occurrences_list", "curated": true } },
    { "operationId": "getTaskRecurrenceOccurrence", "method": "GET", "path": "/task-recurrences/{id}/occurrences/{occurrenceKey}", "scope": "task-recurrences:read", "additionalScopes": ["tasks:read"], "sdk": "taskRecurrenceOccurrences.get", "cli": "task-recurrences occurrences get", "mcp": { "exposure": "read", "tool": "teamgrid_task_recurrence_occurrence_get", "curated": true } },
    { "operationId": "overrideTaskRecurrenceOccurrence", "method": "PUT", "path": "/task-recurrences/{id}/occurrences/{occurrenceKey}/override", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrenceOccurrences.override", "cli": "task-recurrences occurrences override", "mcp": { "exposure": "forbidden", "reason": "Occurrence overrides alter automatic work and are forbidden in every MCP profile." } },
    { "operationId": "clearTaskRecurrenceOccurrenceOverride", "method": "DELETE", "path": "/task-recurrences/{id}/occurrences/{occurrenceKey}/override", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrenceOccurrences.clearOverride", "cli": "task-recurrences occurrences clear-override", "mcp": { "exposure": "forbidden", "reason": "Occurrence override writes are forbidden in every MCP profile." } },
    { "operationId": "retryTaskRecurrenceOccurrence", "method": "POST", "path": "/task-recurrences/{id}/occurrences/{occurrenceKey}/retry", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrenceOccurrences.retry", "cli": "task-recurrences occurrences retry", "mcp": { "exposure": "forbidden", "reason": "Retrying automatic task creation is forbidden in every MCP profile." } },
    { "operationId": "recheckTaskRecurrence", "method": "POST", "path": "/task-recurrences/{id}/recheck", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrences.recheck", "cli": "task-recurrences recheck", "mcp": { "exposure": "forbidden", "reason": "Asynchronous recurrence recovery is forbidden in every MCP profile." } },
    { "operationId": "submitTaskRecurrenceEvent", "method": "POST", "path": "/task-recurrences/{id}/events", "scope": "task-recurrences:run", "additionalScopes": ["tasks:write"], "sdk": "taskRecurrences.submitEvent", "cli": "task-recurrences events submit", "mcp": { "exposure": "forbidden", "reason": "External event ingress can trigger automatic work and is forbidden in every MCP profile." } },
    { "operationId": "getTaskRecurrenceOperation", "method": "GET", "path": "/task-recurrence-operations/{id}", "scope": "task-recurrences:read", "additionalScopes": ["tasks:read"], "sdk": "taskRecurrenceOperations.get", "cli": "task-recurrence-operations get", "mcp": { "exposure": "forbidden", "reason": "Recovery operation metadata is forbidden in every MCP profile." } },
    { "operationId": "cancelTaskRecurrenceOperation", "method": "POST", "path": "/task-recurrence-operations/{id}/cancel", "scope": "task-recurrences:write", "additionalScopes": ["tasks:read", "tasks:write"], "sdk": "taskRecurrenceOperations.cancel", "cli": "task-recurrence-operations cancel", "mcp": { "exposure": "forbidden", "reason": "Recovery operation control is forbidden in every MCP profile." } }
  ],
  "productCapabilities": [
    { "id": "system.discovery", "family": "system", "classification": "public-service", "status": "released", "wave": 0 },
    { "id": "system.capabilities", "family": "system", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "workspace.read", "family": "workspace", "classification": "public-service", "status": "released", "wave": 0 },
    { "id": "workspace.settings", "family": "workspace", "classification": "admin", "status": "released", "wave": 2 },
    { "id": "workspace.entitlements", "family": "workspace", "classification": "public-service", "status": "released", "wave": 0 },
    { "id": "members.read", "family": "administration", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "members.invitations", "family": "administration", "classification": "admin", "status": "released", "wave": 2 },
    { "id": "members.roles", "family": "administration", "classification": "admin", "status": "released", "wave": 2 },
    { "id": "members.groups", "family": "administration", "classification": "admin", "status": "released", "wave": 2 },
    { "id": "credentials.lifecycle", "family": "administration", "classification": "admin", "status": "released", "wave": 1 },
    { "id": "service-accounts.lifecycle", "family": "administration", "classification": "admin", "status": "released", "wave": 1 },
    { "id": "oauth.delegated-users", "family": "administration", "classification": "delegated", "status": "planned", "wave": 3, "owner": "TeamGrid Developer Platform", "deliveryVersion": "1.1.0", "reason": "Delegated user access remains excluded from 1.0 until OAuth 2.1 consent, refresh rotation, revocation, redirect policy, and acting-user audit are qualified together." },
    { "id": "projects.read", "family": "work-management", "classification": "public-service", "status": "released", "wave": 0 },
    { "id": "projects.write", "family": "work-management", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "projects.lifecycle", "family": "work-management", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "projects.sharing", "family": "work-management", "classification": "delegated", "status": "released", "wave": 2 },
    { "id": "projects.templates", "family": "work-management", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "tasks.read", "family": "work-management", "classification": "public-service", "status": "released", "wave": 0 },
    { "id": "tasks.write", "family": "work-management", "classification": "public-service", "status": "released", "wave": 0 },
    { "id": "tasks.lifecycle", "family": "work-management", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "tasks.ordering", "family": "work-management", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "tasks.subtasks", "family": "work-management", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "tasks.bulk", "family": "work-management", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "tasks.recurrence", "family": "work-management", "classification": "public-service", "status": "released", "wave": 3 },
    { "id": "task-metadata.lists", "family": "work-management", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "task-metadata.tags", "family": "work-management", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "task-metadata.services", "family": "work-management", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "custom-fields.definitions", "family": "work-management", "classification": "admin", "status": "released", "wave": 2 },
    { "id": "custom-fields.values", "family": "work-management", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "time-entries.read", "family": "time-planning", "classification": "public-service", "status": "released", "wave": 0 },
    { "id": "time-entries.write", "family": "time-planning", "classification": "public-service", "status": "released", "wave": 0 },
    { "id": "time-entries.timer", "family": "time-planning", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "time-entries.billing", "family": "time-planning", "classification": "admin", "status": "released", "wave": 2 },
    { "id": "planned-work.lifecycle", "family": "time-planning", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "scheduling.availability", "family": "time-planning", "classification": "delegated", "status": "released", "wave": 2 },
    { "id": "absences.lifecycle", "family": "time-planning", "classification": "delegated", "status": "released", "wave": 2 },
    { "id": "calendar.appointments", "family": "time-planning", "classification": "delegated", "status": "released", "wave": 2 },
    { "id": "contacts.read", "family": "crm-collaboration", "classification": "public-service", "status": "released", "wave": 0 },
    { "id": "contacts.write", "family": "crm-collaboration", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "contacts.groups", "family": "crm-collaboration", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "comments.lifecycle", "family": "crm-collaboration", "classification": "delegated", "status": "released", "wave": 2 },
    { "id": "activity.read", "family": "crm-collaboration", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "documents.lifecycle", "family": "crm-collaboration", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "callnotes.lifecycle", "family": "crm-collaboration", "classification": "public-service", "status": "released", "wave": 3 },
    { "id": "telephony.calls", "family": "crm-collaboration", "classification": "delegated", "status": "planned", "wave": 3, "owner": "TeamGrid Developer Platform", "deliveryVersion": "1.1.0", "reason": "Provider-neutral call metadata and actions remain excluded from 1.0 until permissions, retention, and provider-secret isolation have one stable contract." },
    { "id": "files.upload", "family": "files", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "files.download", "family": "files", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "files.lifecycle", "family": "files", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "files.sharing", "family": "files", "classification": "delegated", "status": "planned", "wave": 3, "owner": "TeamGrid Developer Platform", "deliveryVersion": "1.1.0", "reason": "Explicit file-share grants remain excluded from 1.0 until expiry, revoke, download authorization, and audit semantics are qualified without exposing object-storage identifiers." },
    { "id": "products.lifecycle", "family": "commerce", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "product-groups.lifecycle", "family": "commerce", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "project-statements.lifecycle", "family": "commerce", "classification": "admin", "status": "released", "wave": 2 },
    { "id": "commerce.orders", "family": "commerce", "classification": "admin", "status": "planned", "wave": 3, "owner": "TeamGrid Developer Platform", "deliveryVersion": "1.1.0", "reason": "Order lifecycle remains excluded from 1.0 until totals, immutable price snapshots, finance permissions, idempotency, and transition rules form one stable domain contract." },
    { "id": "automation.catalog", "family": "automation-integrations", "classification": "public-service", "status": "released", "wave": 3 },
    { "id": "automation.definitions", "family": "automation-integrations", "classification": "admin", "status": "released", "wave": 3 },
    { "id": "automation.runs", "family": "automation-integrations", "classification": "admin", "status": "released", "wave": 3 },
    { "id": "integrations.status", "family": "automation-integrations", "classification": "admin", "status": "released", "wave": 3 },
    { "id": "search.federated", "family": "search-analytics", "classification": "delegated", "status": "released", "wave": 2 },
    { "id": "reports.jobs", "family": "search-analytics", "classification": "public-service", "status": "planned", "wave": 3, "owner": "TeamGrid Developer Platform", "deliveryVersion": "1.1.0", "reason": "Report jobs remain excluded from 1.0 until saved-query inputs, bounded result schemas, retention, export delivery, and cancellation are stable across report families." },
    { "id": "exports.jobs", "family": "search-analytics", "classification": "public-service", "status": "released", "wave": 2 },
    { "id": "imports.jobs", "family": "search-analytics", "classification": "admin", "status": "planned", "wave": 3, "owner": "TeamGrid Developer Platform", "deliveryVersion": "1.1.0", "reason": "Import jobs remain excluded from 1.0 until secure upload, validate/preview/execute, row-level errors, idempotency, cancellation, and rollback policy are qualified together." },
    { "id": "audit.read", "family": "events-governance", "classification": "admin", "status": "released", "wave": 0 },
    { "id": "audit.export", "family": "events-governance", "classification": "admin", "status": "released", "wave": 2 },
    { "id": "events.catalog", "family": "events-governance", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "events.change-feed", "family": "events-governance", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "webhooks.lifecycle", "family": "events-governance", "classification": "public-service", "status": "released", "wave": 0 },
    { "id": "webhooks.deliveries", "family": "events-governance", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "webhooks.secret-rotation", "family": "events-governance", "classification": "public-service", "status": "released", "wave": 1 },
    { "id": "internal.mongo", "family": "private-internals", "classification": "operator-only", "status": "private", "wave": null, "reason": "Raw storage access bypasses domain and tenant policy." },
    { "id": "internal.ddp", "family": "private-internals", "classification": "operator-only", "status": "private", "wave": null, "reason": "Generic method execution is not a stable public contract." },
    { "id": "internal.superadmin", "family": "private-internals", "classification": "operator-only", "status": "private", "wave": null, "reason": "Shell, migration, reset, and health controls remain operator-only." },
    { "id": "internal.secrets", "family": "private-internals", "classification": "excluded", "status": "private", "wave": null, "reason": "Provider, billing, authentication, and storage secrets are never public data." },
    { "id": "internal.automation-tasks", "family": "private-internals", "classification": "excluded", "status": "private", "wave": null, "reason": "Execution documents remain hidden behind safe automation resources." },
    { "id": "internal.file-sync", "family": "private-internals", "classification": "excluded", "status": "private", "wave": null, "reason": "Device and object-storage protocols remain implementation details." }
  ]
}