Scopes

A scope is a name a credential may carry. The kernel checks it, never the caller — every surface (API, CLI, MCP, SDK) reaches the same gate, so a scope withheld is withheld everywhere at once.

Scopes are also the vocabulary an app asks for consent in, which is why this list holds names that no command carries: an app can request a power a role can then refuse.

The floor

These reads answer every authenticated operator, with no scope at all. No role can exclude them.

read.internal.whoami

The floor of the platform face

These CONTROL reads answer every authenticated PLATFORM operator, with no scope at all. They tell a holder nothing it does not already have — its own identity, the version of the box it is already talking to, the catalog shipped inside that box.

read.control.available_extensions · read.control.platform_info · read.control.whoami

Decided per request

One read name can serve many shapes — an app’s own table, for instance, where each app declares in its manifest what lives in it. For these, the requirement is a function of the read’s own parameters rather than a fixed name, so it is not listed under any single scope above.

read.internal.extension_records

`admin.users.write`

Commands — admin_user.disable · admin_user.enable · admin_user.invite · iam.api_key.create · iam.api_key.revoke · iam.api_key.rotate · operator.access_key.create · operator.access_key.revoke

Reads — read.internal.admin_users · read.internal.api_keys · read.internal.operator_access_keys

`audit.read`

Reads — read.internal.audit · read.internal.promotion_activity

`catalog.admin.read`

Reads — read.internal.brands_admin · read.internal.catalog_labels · read.internal.categories_admin · read.internal.collection_admin · read.internal.collections_admin · read.internal.product · read.internal.product_media · read.internal.product_sku_dimensions · read.internal.product_sku_media · read.internal.product_stores · read.internal.products_admin · read.internal.search_admin

`catalog.category.write`

Commands — catalog.category.create · catalog.category.move · catalog.category.set_custom_fields · catalog.category.update

`catalog.product.publish`

Commands — catalog.product.publish · catalog.product.publish_bulk · catalog.product.unpublish · catalog.product.unpublish_bulk

`catalog.product.write`

Commands — catalog.brand.archive · catalog.brand.create · catalog.brand.update · catalog.collection.archive · catalog.collection.create · catalog.collection.pin · catalog.collection.reorder · catalog.collection.unarchive · catalog.collection.unpin · catalog.collection.update · catalog.media.attach · catalog.media.detach · catalog.media.reorder · catalog.media.update · catalog.option.create · catalog.option.delete · catalog.option.update · catalog.option_value.create · catalog.option_value.update · catalog.product.archive · catalog.product.categorize · catalog.product.create · catalog.product.uncategorize · catalog.product.update

`catalog.read`

Carried by no command and gating no read — a consent symbol an app manifest may ask for. extension.install fences AUTHORITIES only (command scopes ∪ the privileged gates), so a read symbol like this one is grantable: letting an app read the operator’s own tenant is not escalation.

`catalog.sku.write`

Commands — catalog.sku.create · catalog.sku.delete · catalog.sku.update

`composition.write`

Commands — composition.move · composition.place · composition.placement.remove · composition.placement.reorder · composition.placement.set · composition.remove · composition.reorder · composition.toggle · composition.update_config

`content.read`

Reads — read.internal.assets · read.internal.pages

`content.write`

Commands — content.page.archive · content.page.create · content.page.update

`custom_fields.write`

Commands — custom_field.archive · custom_field.define · custom_field.update

`customer.admin.write`

Commands — customer.anonymize · customer.set_custom_fields · customer_cluster.archive · customer_cluster.create · customer_cluster.pin · customer_cluster.unarchive · customer_cluster.unpin · customer_cluster.update

Reads — read.internal.cluster_admin · read.internal.clusters_admin · read.internal.customer · read.internal.customers

`customer.self.read`

Carried by no command and gating no read: it marks the shopper’s own session credential. The customer read face gates on the session’s actor type and on the caller’s own customer id, never on this name.

`customer.self.write`

Commands — customer.address.create · customer.address.delete · customer.address.update · customer.end_session · customer.link_cart · customer.update_profile · order.request_cancellation

`extensions.egress.consent`

Commands — extension.connection.set

`extensions.read`

Reads — read.internal.available_extensions · read.internal.extension_composition · read.internal.extension_config · read.internal.extension_health · read.internal.extension_runs · read.internal.installed_extensions · read.internal.instance_extensions · read.internal.payment_methods_admin · read.internal.payment_offers

`extensions.write`

Commands — extension.config.set · extension.install · extension.uninstall · notification.channel.register · payment.offer.set

`iam.roles.write`

Commands — admin_user.set_role · role.archive · role.create · role.update

Reads — read.internal.roles

`inventory.adjust`

Commands — inventory.adjust · inventory.set_level · warehouse.create · warehouse.update

`inventory.reserve`

Commands — inventory.commit · inventory.reclaim_expired · inventory.release · inventory.reserve

`logistics.read`

Reads — read.internal.availability_admin · read.internal.availability_by_skus_admin · read.internal.carriers · read.internal.pickup_location · read.internal.pickup_locations · read.internal.routing_suggestion · read.internal.shipping_methods_admin · read.internal.shipping_rates · read.internal.shipping_simulation · read.internal.shipping_zones · read.internal.stock_addable_skus · read.internal.stock_levels · read.internal.warehouses

`media.write`

Commands — asset.archive · asset.create · media.request_upload

`notification.send`

Commands — notification.send

`operator.otp.request`

Commands — operator.request_otp

`operator.self.write`

Commands — admin_user.set_locale

`operator.session.mint`

Commands — operator.mint_oidc_session · operator.verify_otp

`order.payment.write`

Commands — order.payment.record

`order.read`

Reads — read.internal.notification (any of order.read · order.write) · read.internal.notifications (any of order.read · order.write) · read.internal.order_admin (any of order.read · order.write) · read.internal.orders_admin (any of order.read · order.write) · read.internal.sales_metrics (any of order.read · order.write) · read.internal.shipment_queue (any of order.read · order.write)

`order.write`

Commands — notification.resend · order.cancel · order.cancel_request.approve · order.cancel_request.decline · order.comment.add · order.create · order.document.attach · order.expire_unpaid · order.hold · order.mark_delivered · order.mark_paid · order.mark_preparing · order.mark_shipped · order.refund · order.release_hold · order.shipment.create · order.shipment.mark_delivered · order.shipment.mark_picked_up · order.shipment.mark_ready_for_pickup · order.shipment.mark_shipped · order.shipment.set_tracking · order.shipment.update_tracking_status

Reads — read.internal.active_carts · read.internal.notification (any of order.read · order.write) · read.internal.notifications (any of order.read · order.write) · read.internal.order · read.internal.order_admin (any of order.read · order.write) · read.internal.orders_admin (any of order.read · order.write) · read.internal.sales_metrics (any of order.read · order.write) · read.internal.shipment_queue (any of order.read · order.write)

`orders.read`

`pii.read`

Carried by no command and gating no read on any face published here: a privileged operator gate, checked directly by the kernel. extension.install fences it as an authority, so an app is never granted it — an operator may only consent powers they hold, and this is one.

`platform.admin_driver.mint`

Commands — platform.admin_driver.mint

`platform.bulk_read`

Carried by no command and gating no read: the bulk read face’s platform gate. A platform actor holding it reads /v1/read/bulk/* for every store this instance serves, instead of a tenant credential reading its own. It buys BUDGET, not data — the bulk face answers exactly what the anonymous face already answers.

`platform.extension.action`

Carried by no command and gating no read: a gate a HAND-WRITTEN face enforces against a platform actor. It is invisible to every generated surface, which is why the kernel declares it explicitly (packages/core/src/iam/hand-written-gates.ts). An app manifest that asks for this name is granted a word, not a power.