Platform services your app can reach

The access register — every grant an App may declare and what each one unlocks, plus the events it emits and receives, its scheduled work, person-level permissions and tracing.

The access register

Permissions

The nine grant kinds, deny-by-default, install-time consent and consent drift.

Entity access

Which of your own tables the app may read and write, per operation.

Tenant identity

The tenant's users, teams and sessions — and zero-secret auth from the injected context.

Outbound HTTP

Declaring external egress per host and path, and the honest state of enforcement.

Not yet proven

The storage, secret, mail, ai and inbound grants — declarable, used by no app.

Being invoked, and being observed

Events you emit

Declarative emits — the trigger model, the name shape, payload locators and channels.

Events you receive

Branching on the trigger headers, idempotent handlers, and which events are actually verified.

Scheduled work

Cron schedules in UTC, per-tenant ticks, and warmup.

Person permissions

provides_permissions, provides_roles, require_principal and the injected principal headers.

Tracing

Standard OTEL_* configuration, the per-invocation span, and what happens when it is unset.

An App gets no access by default. Everything it may reach — its own tables, another app's capabilities, an external host — is one entry in manifest.permissions. That array is the app's access register: a single declarative list, read by the platform to enforce access at runtime and read by the merchant at install time as the consent screen.

There is no policies block. If you have seen one in an older example or a generated file, it is wrong — no shipped app has one, and the manifest schema rejects the key.

manifest.json
"permissions": [
  { "entity": "device_serials", "access": ["read", "create", "update"] },
  { "identity": "users", "access": ["read"] },
  { "capability": "orders.get", "compatible": "^1.0" },
  { "outbound": "api.acme-service.example", "paths": ["/v2/*"] }
]

Be honest about what is proven

This group is explicit about maturity, because building on an unbuilt capability is the most expensive mistake available to you here.

GrantStatus
entity, identity, capabilityShipped. Exercised by every production app.
outboundDeclared and honoured as intent. Enforcement is still being built.
storage, secret, mail, ai, inboundDeclarable, used by no app. No production behaviour to describe.

Every page in this group says where its subject sits. See Not yet proven for the five to treat with care.

Beyond the register

Three things in this group are not grants, but they are the other ways your app touches the platform rather than the other way round:

  • Events — declarative in both directions. There is no publish API to call and no subscribe callback to register.
  • Scheduled work — cron, run per installed tenant.
  • Person permissions — what a human may do, which is the opposite direction from permissions.

And one is neither: tracing is how you see what your app did.

Next steps