The on-behalf log flags patient information only for patient-record tools
Live: every notifications read was flagged as patient information (notifications_list is phiSensitive in general). The member-facing flag now follows the tool's...
MLOS tool writes carry the approval they run on
So SecurityService can tell a person's approval or order from an SI's own initiative, which the lender may have switched off (LOAN_SI_CHANGES).
Wake-up list carries ids, cancel one by id, never ask for a confirmation (TPWAKEUP)
Owner live test 2026-10-28: the SI asked him to approve before removing a duplicate wake-up. The tools say anyone may list and cancel for any number with no con...
Today:true answers only today's figures
Live (sp00verify 07:58Z): with today:true the answer carried receivedToday 0 beside the all-time total 12, and the SI reported 12. A today answer now holds rece...
Notifications_list today:true counts what arrived today in the owner's zone
TPONBEHALF live check (sp00verify 2026-10-28 07:27Z): asked "how many notifications did I get today?", the SI read the member's own account correctly (on behalf...
OnBehalfOf — an SI acts through its higher-up's own account on their authenticated request
TPONBEHALF (owner 2026-10-28): Sage asked Luna how many notifications HE got today and she could only read her own. On an authenticated request from anyone up t...
SI mortgage reads take View Own Mortgage Loans
Every MLOS staff right now implies View Own Mortgage Loans, and SecurityService narrows a member without View Mortgage Pipeline to the loans they are assigned l...
Phone_schedule_wakeup, phone_cancel_wakeup, phone_list_wakeups (TPWAKEUP)
Owner order 2026-10-28, the first SI easter egg: anyone, signed in or not, on any channel, may ask an SI for a wake-up call (or cancel the ones for any number)....
Cancelling its own outside-meeting join is the SI's bookkeeping, no approval (TPEXTMEET)
Found live in sp00verify: a teammate's "cancel that join" went to the owner for approval (UPDATE_RECORD). Also passes whenInInvitationZone through. Goldens rege...
Meetings_join_external, **************** meetings_cancel_external (TPEXTMEET)
An SI joins an outside meeting (Zoom, Teams, Meet, Webex, GoTo, any provider) from the details a teammate gave it, now or at the invitation's start, by phone. J...
A signed-in supervisor's meeting request is their order even when terse ("Nell email Cole, supervisor test")
TPMEETAUTH live (sp00verify call 8daf1817): the supervisor's line was attributed SOLE / SUPERVISOR from their own stream, but DirectOrder did not read "Nell ema...
In a meeting, the line's own speaker decides authority (signed-in supervisor orders, teammate asks, guest is anyone)
TPMEETAUTH (owner order 2026-10-26). kamoai-voice names the meeting line a call answers (X-Kamo-Meeting-Turn, never the model); MeetingTurns asks kamoai-service...
A weak citation never hides the member's confirmation (order and approval stand-in)
Live 2026-10-27 (sp00verify, approval bc7dfe20): after KC Vera confirmed, the SI cited the unproven email it was asked in; that soft-refused and replaced both t...
A member's confirmation in Kamo is the request an outside send carries (no approval for what their rights allow)
Live 2026-10-27 (sp00verify, request db6fff36): KC Vera confirmed in Kamo and the run ran on her order, yet mail to an outside address still went to the SI's su...
Anti-impersonation guard — an unverified conversation gets only what anyone may ask until the member confirms in Kamo
Owner 2026-10-26 (TPCALLTOOLS B): someone who only CLAIMS to be a member, a supervisor or someone in authority must not get the SI to do anything harmful or tha...
Calendar_create_event invites teammates by member id, so 'put it on my calendar' reaches the person who asked
Nobody may write another member's calendar (EmailService: own calendars, the org calendar with the publish right), so a union of rights cannot either. inviteMem...
Identity checks about a named message; an unproven email whose sender confirmed is their order
identity_request_confirmation takes 'about' (email:<folder>/<uid>, chat:<guid>) for a message that is not the run's own wake (a check-in handling it). An email ...
Every notification kind decided (BILLING_INVOICE not offered to SIs); ClockPack names its Spring constructor
NotificationsPackTest and KnowledgeAndPeoplePacksTest were red on main since shared-lib added BILLING_INVOICE. ClockPack keeps its test constructor; the one Spr...
Audit the SI Assistant's calls as made on the member's behalf
The member's personal SI Assistant (TPASSIST) calls with the member's own session; its keys start assistant:, and such a call by a person is audited with author...
Holdem_* - an SI plays Texas Hold'em with members
SITP TPGAMES. Twelve tools over MediaService's Hold'em endpoints, gated as a member's seat is (Hold'em app + PLAY_HOLDEM, again downstream): holdem_list_tables,...
Tool-list snapshots regenerated with identity_request_confirmation after rebase
Identity_request_confirmation; a request the member confirmed in Kamo is their order
Owner 2026-10-26: direct orders must be authenticated. Someone who only claims to be a teammate (phone, text, unproven email, website chat, meeting) is asked, t...
Mail_send takes an HTML body's plain-text version and one text file written by the caller (TPRECAPS)
The SI's meeting recap now carries the meeting's full transcript; past the body's limit it goes as a .txt attachment. textBody (with bodyFormat HTML) becomes th...
Games_* - an SI plays chess with members
SITP TPGAMES. Eleven tools over MediaService's chess endpoints, gated as a member's board is (Chess app + PLAY_CHESS, again downstream): games_list, games_get_s...
Every SI has a clock: time_now, time_convert, time_calc
Owner report 2026-10-26: asked the time on a call, an SI said it had no clock. The clock and calendar every person has: the time now in the SI's zone or any oth...
A teammate's proven email to an SI is their request and their order
Owner report 2026-10-26: the owner emailed their SI to call them; the email was never an order ([ORDER] no order) and every later check-in read it as outside ma...
Declare every right a tool's service enforces; plain words for unseen records and numbers
Approval follow-up 2026-10-21 (controller review of the approvals UI). Rights (item 4): an audit of every tool's declared rights against the rights its downstr...
Honour standing permissions; offer Approve and always allow on the card
CharterPolicy reads resolved.toolApprovals and each rule's standing flag. A member's rule about one tool stands for its class's rule for that tool; a standing p...
An approval card sends every parameter its phrase names
next-intl refuses an ICU select or plural with no value, so a phrase about an argument the SI left out (a contact with no formatted name, a new document categor...
An approval about a record the reader may not see never leaves a dangling 'for'
Phrases that named a patient, a customer, a purchaser, an envelope or a document after a preposition now say 'for a patient' (or nothing) when the reader may no...
Approval cards say SI in every label, write phone numbers and choices as people do, and keep a note beside an action a field
A humanised field name said 'Ai companion…' (now SI, with a guard that no phrase, label, noun or risk sentence says AI); a US number reads (512) 555-0142 in the...
Plain-language approval cards, worded as the reader may see them
Owner order 2026-10-20: approvals showed members GUIDs and JSON. POST **************** (internal auth) words each approval for a non-technical person: one sente...
Sms_read_attachment, and sms_read_thread names what was texted in (SITP MMS)
TP11 deferred sms_read_attachment because VOIPService kept no inbound MMS media; it does now (voipservice@8eda899). So: - sms_read_thread lists each inbound pa...
An SI on a teammate's order can find and operate just the function the order needs; on god's order also unverified ones (IoT R7 round 3)
- IotPack.planSend: when the SI's own view lacks the device or the function (or may not OPERATE it) and the caller is on an order-scoped session, IoTService's...
An order's tool call runs on a per-call scoped order session that lends only what the tool needs (No Insubordination Rule, IoT R7 round 3)
OrderDelegation.resolve takes a CallScope: the tools/list keeps the session lending the requester's whole standing (kamo:tool:order:<runId>), so the SI knows wh...
An SI on god's order sees and can ask for god's devices (IoT R7, No Insubordination Rule)
IotViewRules: an SI's manifest whose caller block names god's standing (caller.god PLATFORM | BREAK_GLASS) and the requester (caller.godOnOrderOf) keeps SAFETY_...
Mlos_update_section keeps what the call does not give (SITP TP21 live smoke)
The loan, property, declarations, military and row saves replace their whole section in SecurityService, so a partial edit would have cleared the fields it left...
Mortgage loan files for SIs: pipeline, the application, readiness, conditions, documents, disclosures, pricing and locks, AUS, vendor orders, consent and the edits (SITP TP21)
43 mlos_* tools (MlosPack) through SecurityService's loan-officer door **************** SITP TP21 securityservice@27e06020) as the SI member, never the MLOS ser...
Patient Records for SIs: the schedule, the front desk, chart and FHIR reads, note drafts and the revenue cycle, with payment posting (SITP TP23)
18 ehr_* tools (EhrPack) over SecurityService's EHR controllers as the SI member; each names the right SecurityService checks there, and anything inside one cha...
A loan record's dateUpdated is a UTC instant too (SITP TP22 live smoke)
The live smoke answered loans_get_state_rule and loans_history with dateCreated as a UTC instant and dateUpdated as KamoLOS's offset-less text; both are now ins...
Reports_save_view does not answer empty settings for a view it just saved (SITP TP16 live smoke)
SecurityService answers a save without the view's stored request (the list carries it), so the tool said parameters {} for a view saved with parameters. A view ...
Support tickets, system bugs, marketing materials, Growth Hub, tracking codes and social pages for SIs (SITP TP15)
54 new SI tools, each checked by the same rights at the gateway and at MediaService (DocsService for the materials list): - support_*: list (with the queue's co...
IoT field-service reads and alarm handling for SIs: sites, a customer's and a work order's devices, history, commands, an alarm, the summary, acknowledge several, shelve, unshelve, note (SITP TP19)
Eleven iot_* tools in the IoT pack, by its own conventions: offered per caller from the manifest (IotTools.RIGHT, the view's withholding reasons), every device,...
Personal loans for SIs: the book, payments, payoff, history, statements, fees, offers, promises to pay and the money acts (SITP TP22)
27 loans_* tools (LoansPack) straight to KamoLOS through its one-time-key door (SITP TP02, new downstream LOS, X-OTK) as the SI member; KamoLOS checks the PLOS ...
E-signatures for SIs: read a template, track sent documents and a record's requests, send, remind, resend, void (SITP TP19)
Eight esign_* tools (EsignPack) through a new ESIG(OTK) door to ESigService's staff API, as the SI member; ESigService checks every right itself (SITP TP02) and...
An SI prepares the draft commission payout batch, never sends it (SITP TP18)
commissions_draft_batch (open the DRAFT batch, or find the open one) and commissions_edit_draft_line (ADD / UPDATE / REMOVE a draft line; UPDATE restates the wh...
The organization's web analytics for SIs: websites, traffic, top pages and sources (SITP TP16)
analytics_list_websites, analytics_website_stats (views, visitors, visits, bounces, time on site, the period before, who is on now), analytics_website_metrics (...
The tool lists gain exactly SITP TP16's four saved-view tools and reports_run's viewId
Snapshots regenerated on top of TP17 and TP18: reports_run changes (viewId); every other change is a new reports_*_view tool.
Saved report views for SIs: list, save, delete, share, and reports_run by viewId (SITP TP16)
reports_list_views, reports_save_view (create or change; a change keeps what it does not name), reports_delete_view, reports_share_view (SHARE_REPORTS; the endp...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.