Every system you run can be talked to.

01

Two handles, two blast radii.

A running product has two handles on purpose: the container — logs, restart, a shell — and the system, its own API. Restarting a process for ten seconds and merging two customer records forever are different risks, so they are separate pages behind separate permissions: stacks.manage for the container, systems.manage to change what the product exposes, systems.use to call it.

• @crm-api restart bounces a process.
• @crm-agent contacts.merge changes customer data and cannot be undone.
• Collapsing them would put both behind one grant. They never are.

03

Try any tool — it asks the right question.

Each tool has a class: read, write, destructive or external. A read runs. A write or a tool that reaches outside asks you to confirm. One that cannot be undone asks for its name, typed back. Anything that does not declare itself read-only is treated as a write — the safe way to be wrong — and “reversible” is never guessed: you set it.

• Try it builds a form from the tool’s own input schema.
• A tool the server calls destructive can’t be made undoable by hand.
• Reading the system again keeps your corrections for the tools it still offers.

05

One registry for every tool.

The Registry lists every tool of every system in the organization — searchable, by class and by system, with how much each was used in the last 30 days and its argument schema. Connectors and the agents you build are on the same list, not a second one.