A Home Assistant lab instance at home.kamouniverse.com
One Home Assistant 2026.10.2 (digest-pinned) for IoT testing of Kamo's HOME_ASSISTANT connector and for the owner's own use under the HA account sajon. The demo...
The Alexa skill is named KamoUniverse, invoked as "kamo universe" (SP09) [skip ci]
A loan's assessed fees can be read, so a fee can be named to waive it (SITP TP22)
GET /api/los/fees/by-loan/{loanId}: the loan's fees (late, NSF, annual), newest first, waived or not; PLOS_VIEW_PIPELINE (LosRightsFilter, as every read) and th...
Mirror PREPARE_COMMISSION_PAYOUTS (570) under VIEW_ORG_FINANCES (SITP TP18)
Composing the draft commission payout batch without sending it; display string matches RoleRightType.java exactly. Listed with the other finance rights under Ac...
PREPARE_COMMISSION_PAYOUTS composes the draft payout batch, seeded to every finance manager (SITP TP18)
Opening the draft batch and adding, changing or removing its lines now take MANAGE_ORG_FINANCES or PREPARE_COMMISSION_PAYOUTS (the owner always); sending a batc...
The share host alias is devices (master §10 R6) [skip ci]
Owner 2026-10-18: "IoT" is a technical term, so the kamo-iot host is devices.<org domain> and the platform host devices.kamouniverse.com only; kamocrm.com is a ...
The organization's web analytics for SIs: websites, traffic, top pages and sources (SITP TP16)
analytics_list_websites, analytics_website_stats (views, visitors, visits, bounces, time on site, the period before, who is on now), analytics_website_metrics (...
A loan offer is drafted only on the organization's own product and borrower, the aging report counts only its loans, and staff acts are the organization's (SITP TP22)
- POST /api/los/offers: the product must be the caller's organization's and the borrower a member of it (or of a child organization); a body naming another te...
A template above the caller's clearance cannot be read or sent, and a staff employment offer takes an HR right (SITP TP19)
The envelope door already hid an envelope whose template sits above the session's clearance and an EMPLOYMENT_OFFER envelope from a member without an HR right, ...
The studio's required devices card
The DNS studio lists "devices" as a required core record with the Router icon, so every organization with its own domain is asked for devices.<domain>: the host...
Set the Google Trust Services EAB key id (IoT SP09 B1)
The gts-prod ClusterIssuer's external account binding names key id **************** from Google Cloud Public CA (project kamocrm-1755458510147). The HMAC key is...
Reserve the devices alias, not iot
The kamo-iot share pages are served at devices.<domain> (owner 2026-10-18: the host is customer-facing, and "IoT" is a technical term), so the new-organization ...
The tool lists gain exactly SITP TP16's four saved-view tools and reports_run's viewId
Snapshots regenerated on top of TP17 and TP18: reports_run changes (viewId); every other change is a new reports_*_view tool.
Saved report views for SIs: list, save, delete, share, and reports_run by viewId (SITP TP16)
reports_list_views, reports_save_view (create or change; a change keeps what it does not name), reports_delete_view, reports_share_view (SHARE_REPORTS; the endp...
The kamo-iot host label is devices, not iot
DomainAliasType.IOT keeps its internal name but now carries the customer-facing label "devices" (owner 2026-10-18: "iot" is a technical term; URLs say devices)....
Devices is a standard alias
Required like careers and computers: the record is what makes shared device access open anywhere. The kamo-iot share pages are served at devices.<domain>; the l...
Reserve the devices alias, not iot
The kamo-iot share pages are served at devices.<domain> (owner 2026-10-18: "iot" is a technical term; anything customer-facing says devices). OrgAliasPolicy res...
PREPARE_COMMISSION_PAYOUTS (570), compose a draft payout batch without sending it (SITP TP18)
MANAGE_ORG_FINANCES composes and sends a commission payout batch, and an SI can never hold it (AiRightsFloor), so a finance SI could prepare nothing for a perso...
An SI reads its own and its managed members' work, and cancels its own queued sends (SITP TP20)
Owner decision 2 (2026-10-18). Eleven AI_ONLY tools, each calling the owning service as the SI itself (its own session; new KamoService.KAMOAI door), which scop...
Plans & Billing for SIs: plan, catalogue, accounts, seats, invoices, usage, provider status, seat assign and remove (SITP TP18)
Nine billing_* tools (BillingPack) through SecurityService's billing door (SITP TP02's BillingRelayController; TP18 added the licensee step and the usage reads)...
The share host is devices.<domain>, and nothing on kamocrm.com
Owner 2026-10-18: "iot" is a technical term, so the customer-facing host alias for kamo-iot is `devices`, and kamocrm.com is a marketing site only. auto-cert do...
An SI reads the checklists of a member it manages (SITP TP20)
Owner decision 2 (2026-10-18): an SI may see the work of the members it manages, SIs and people alike, read-only. GET **************** now answers an SI session...
Timecards, leave, breaks and attendance, payroll reads and commission reads for SIs (SITP TP18)
25 tools, so an SI does in HR -> Attendance, Payroll and My Commissions what a person does, within its rights, through SecurityService's TimecardController, Pay...
The billing door makes a member a licensee before a seat, and reads usage for the org billing rights (SITP TP18)
BillingService's LicenseService.assign refuses anyone who is not already a licensee of the subscription, so the relay's seat assign alone could not seat a new m...
A scheduled report reaches a colleague who signs in on another domain (SITP TP16 live smoke)
reports_schedule judged a colleague by the organization's mail domains alone, so in sp00verify the owner's own sign-in address was refused as an outsider. A rec...
Mirror the SITP TP02 rights (440-442) and their parents
MANAGE_ANALYTICS under VIEW_ANALYTICS (Analytics changes, now that each member signs in as themselves), and VIEW_ORG_BILLING with MANAGE_ORG_BILLING under it (o...
Quotes, service work, orders, the commerce pipeline and catalog, subscriptions and reserved opportunities for SIs (SITP TP17)
86 tools over SecurityService as the SI member, each right checked there as well as here: - quotes_*: find, read (share links never carry their address), create...
HR reads a member's leave balances, as it already spends and corrects them (SITP TP18)
GET **************** own on identity (as /me/accruals), anyone else's with MANAGE_TIMECARDS, the right that already gates /use and /adjust on the same balances;...
Subscription records, market lists and order notes reach only the caller's organization (SITP TP17)
SubscriptionService reads a subscription, its order, invoice and agreement by uid alone, in any tenant. POSController now checks the record is the session organ...
Rights-carrying doors to commerce invoices and billing, and the MANAGE_ANALYTICS backfill (SITP TP02)
Commerce invoices: InvoicingService's CommerceInvoiceController checks no right by design (it expects SecurityService to own the session and the rights) and not...
Binders_create sends what CreateBinderRequest reads; scripts_create names a market by its leads_list_markets id (SITP TP14 live smoke)
DocsService refused every binders_create: CreateBinderRequest's primitive isTemplate binds as "template", so the body's isTemplate was an unknown field (400). A...
The tool lists gain exactly SITP TP16's 30 tools and reports_run's page
Snapshots regenerated (-Dtoolplane.parity.write / -Dtoolplane.golden.write) on top of TP14: the only changed entry is reports_run (page, and its description); e...
Billing accounts answer to VIEW_ORG_BILLING / MANAGE_ORG_BILLING, and the listing shows a member only their own (SITP TP02)
BillingService authorized 'own account or organization owner' and never consulted a right, so the owner could not hand billing to an administrator or an SI. Acc...
Report options, export, paging and schedules; rights explained; org structure; settings screens by their rights (SITP TP16)
30 new SI tools, each asking the right the screen's endpoint checks (rights enforced twice): - reports_options (a picker's live choices), reports_run pages thro...
SITP TP02 rights — MANAGE_ANALYTICS (440), VIEW_ORG_BILLING (441), MANAGE_ORG_BILLING (442)
MANAGE_ANALYTICS: Analytics signed every caller in as one shared analytics administrator, so VIEW_ANALYTICS let anyone create, edit and delete every tracked web...
State licences are read and replaced only within the caller's organization (SITP TP16)
GET/PUT **************** found the member by id alone, so a holder of STATE_LICENSING_VIEW_ALL / EDIT_ALL in one organization could read, replace or delete anot...
Documents, KB writing and review, careers screening, checklists, sales scripts and binders for SIs (SITP TP14)
84 tools and docs_search filters, so an SI can do in Docs, the knowledge base, HR careers, checklists, sales scripts and binders what a person does, within its ...
Email templates and the org calendar/contacts connection take MANAGE_EMAIL_SETTINGS (SITP TP02)
EmailTemplateController and EmailTemplateCategoryController checked a session alone: any member could list, read, preview, create, edit, archive, duplicate or r...
An RSVP from a member with no mailbox says so (409 NO_MAILBOX), not a bare 400 (SITP TP12 live smoke)
KamoLOS checks the PLOS right and the organization on every route, and opens a one-time-key door (SITP TP02)
KamoLOS enforced no right: kamo-internal's /api/los proxy was the only gate. LosRightsFilter now applies the proxy's own requiredRight() table (LosRights) to ev...
The Interaction Center and the hexheads stand aside for a guided tour too
Follow-up to 2363d832, which cleared the dock windows. Two more surfaces could still sit in the spotlight: - The Interaction Center. A tour step (Online Meetin...
Sending for signature takes EDIT_DOCUMENTS and reading a template takes VIEW_DOCUMENTS (SITP TP02)
POST /api/esig/envelopes (create and send) checked no right, so any org session could send any template out for signature; it now takes EDIT_DOCUMENTS, the righ...
Chat_send_file posts a text document DocsService typed octet-stream as text/plain (SITP TP13)
DocsService records Markdown, YAML, logs and other text without an ImageMimeType as application/octet-stream, which chat's attachment allow-list refuses. A docu...
StrictReadTest expects a withheld SI card to be passed on as the DM it learned from
Since c13c47b (ruling CP07-T43-1/-7) a withheld record no person owns or takes part in stands in the withheld store for its inherited sources the audience may n...
Review steps stay in the caller's organization; pins take VIEW_KB_ARTICLES (SITP TP14)
submit-review, approve and reject named an article by guid alone, so a member holding CREATE_/REVIEW_KB_ARTICLES in one organization could move another organiza...
Binders and the share lists take VIEW_DOCUMENTS (SITP TP14)
Every BinderController route (list, get, create, scratch, update, duplicate, delete, items, reorder, shares, render) took a session alone, so a member without V...
The tool lists gain exactly SITP TP12's 25 tools, calendarId and the IoT/RPM notification kinds
Snapshots regenerated (-Dtoolplane.parity.write / -Dtoolplane.golden.write): the only changed entries are calendar_create_event (calendarId) and notifications_l...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.