@aifabrix/builder 2.60.0 → 2.62.0

package/README.md

@@ -88,17 +88,20 @@ Use `--pro-password-mode manual` to enter passwords yourself (one password for a
 
 Admin credentials are stored in **`~/.aifabrix/admin-secrets.env`** (encrypted when you configure a secrets encryption key). App and integration secrets stay in **`~/.aifabrix/secrets.local.yaml`**.
 
-### Optional: set AI keys outside the wizard
-
-- **OpenAI:**
-  ```bash
-  aifabrix secret set secrets-openaiApiKeyVault <your-openai-secret-key>
-  ```
-- **Azure OpenAI:**
-  ```bash
-  aifabrix secret set azure-openaiapi-urlKeyVault <your-azure-openai-endpoint-url>
-  aifabrix secret set secrets-azureOpenaiApiKeyVault <your-azure-openai-secret-key>
-  ```
+### Configure an LLM provider
+
+`aifabrix setup` does not collect LLM credentials. Store the selected provider value
+under its standard address in your local or shared secrets store:
+
+```bash
+aifabrix secret set openai/apiKey <your-openai-secret-key> --shared
+```
+
+The same pattern applies to `azure-openai/apiKey`, `azure-openai/endpoint`, and
+`anthropic/apiKey`. When an integration manifest references the matching `kv://`
+address, `aifabrix upload` resolves the value from local or shared storage and pushes
+it to the Dataplane without placing the value in the manifest. Miso onboarding can
+also configure these standard addresses directly.
 
 Remove the platform completely: `aifabrix teardown`. Command details: [Infrastructure commands](docs/commands/infrastructure.md#aifabrix-setup).
 

package/docs/README.md

@@ -0,0 +1,80 @@
+# AI Fabrix Documentation
+
+Table of contents for all AI Fabrix Builder documentation.
+
+← [Back to project README](../README.md)
+
+---
+
+## Getting started
+
+| Document                                                          | Description                                                                     |
+| ----------------------------------------------------------------- | ------------------------------------------------------------------------------- |
+| [Build path index (public docs)](get-started/build-path-index.md) | Map CLI tasks to canonical guides on docs.aifabrix.ai (Build AI-ready systems). |
+| [Your own applications](your-own-applications.md)                 | Create, configure, build, and run your own app (app-centric).                   |
+| [CLI Commands Reference](commands/README.md)                      | All CLI commands and options (alias: use `af` for `aifabrix`).                  |
+
+**Example application and SDK:** For an example app and TypeScript/Python client to talk to the dataplane and controller, see [aifabrix-miso-client](https://github.com/esystemsdev/aifabrix-miso-client).
+
+---
+
+## Platform and infrastructure
+
+| Document                                           | Description                                                                                                 |
+| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| [Infrastructure](infrastructure.md)                | Local Docker infra only (Postgres, Redis, optional pgAdmin/Redis Commander/Traefik). Azure via Marketplace. |
+| [Configuration reference](configuration/README.md) | env-config, env.template, application.yaml, secrets, deployment key.                                        |
+
+---
+
+## External systems and integration
+
+| Document                                | Description                                               |
+| --------------------------------------- | --------------------------------------------------------- |
+| [External systems](external-systems.md) | External system integration (e.g. HubSpot), step-by-step. |
+| [Wizard](wizard.md)                     | Interactive or headless wizard for external systems.      |
+| [GitHub workflows](github-workflows.md) | CI/CD and GitHub Actions.                                 |
+
+---
+
+## Applications and deployment
+
+| Document                                                                    | Description                                                                               |
+| --------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
+| [Building](building.md)                                                     | Build process and Docker images.                                                          |
+| [Running](running.md)                                                       | Run applications locally.                                                                 |
+| [Deploying](deploying.md)                                                   | Deploy to Azure and environment setup.                                                    |
+| [Deployment – first-time environment](deployment/environment-first-time.md) | First-time environment setup.                                                             |
+| [Developer isolation](developer-isolation.md)                               | Port isolation (one network per developer), remote Docker, and dev init for remote setup. |
+
+---
+
+## Commands by topic
+
+| Topic                   | Document                                                                |
+| ----------------------- | ----------------------------------------------------------------------- |
+| Authentication          | [Authentication commands](commands/authentication.md)                   |
+| Infrastructure          | [Infrastructure commands](commands/infrastructure.md)                   |
+| Developer isolation     | [Developer isolation commands](commands/developer-isolation.md)         |
+| Application management  | [Application management commands](commands/application-management.md)   |
+| Application development | [Application development commands](commands/application-development.md) |
+| Role Assistant packages | [Role Assistant packages](commands/role-assistant-package.md)           |
+| Agent Kit               | [Agent Kit commands](commands/agent-kit.md)                             |
+| Deployment              | [Deployment commands](commands/deployment.md)                           |
+| Validation              | [Validation commands](commands/validation.md)                           |
+| External integration    | [External integration commands](commands/external-integration.md)       |
+| Utilities               | [Utility commands](commands/utilities.md)                               |
+| Reference               | [Command reference](commands/reference.md)                              |
+
+---
+
+## Configuration details
+
+| Document                                                                                                  | Description                                                                           |
+| --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
+| [Deployment key](configuration/deployment-key.md)                                                         | How deployment key is calculated; why Miso Controller and Dataplane use the same key. |
+| [env-config](configuration/env-config.md)                                                                 | Environment configuration.                                                            |
+| [env.template](configuration/env-template.md)                                                             | Environment template and variables.                                                   |
+| [application.yaml](configuration/application-yaml.md)                                                     | Application config.                                                                   |
+| [Secrets and config](configuration/secrets-and-config.md)                                                 | Secrets and configuration.                                                            |
+| [External integration config](configuration/application-yaml.md#external-integration-and-external-system) | External system configuration.                                                        |

package/docs/builder-help/evidence-patterns.json

@@ -0,0 +1,155 @@
+{
+  "schemaVersion": "1.2.0",
+  "patterns": [
+    {
+      "key": "section-read-before-patch",
+      "title": "Read section before patch",
+      "summary": "Obtain sectionReadToken from GET before any PATCH on the same sectionKey.",
+      "role": "integrator",
+      "resourceType": "datasource",
+      "steps": [
+        "GET manifest section for the target sectionKey",
+        "Review quality.missingInputs and resolve required questions with the user",
+        "PATCH with intent and the sectionReadToken from the GET response"
+      ],
+      "relatedTopics": ["workflow", "section"]
+    },
+    {
+      "key": "repair-after-metadata",
+      "title": "Repair after metadata patch",
+      "summary": "Run fieldMappings, expose, and rbac repair hooks after datasource metadata changes.",
+      "role": "integrator",
+      "resourceType": "datasource",
+      "steps": [
+        "PATCH datasource.metadata with intent describing vendor field mapping",
+        "POST manifest repair with hooks fieldMappings, expose, rbac",
+        "Validate workspace manifests before test"
+      ],
+      "relatedTopics": ["repairRules", "dependencyGraph", "workflow"]
+    },
+    {
+      "key": "validate-test-gate",
+      "title": "Validate and test before upload",
+      "summary": "Complete validate and test ladder before dev upload or certification.",
+      "role": "operator",
+      "resourceType": "system",
+      "steps": [
+        "Run validate on the workspace",
+        "Run integration or e2e test as appropriate",
+        "Proceed to upload or certify only after both succeed"
+      ],
+      "relatedTopics": ["workflow", "goldenExamples"]
+    },
+    {
+      "key": "ask-required-missing-inputs",
+      "title": "Ask for required missing inputs",
+      "summary": "When quality.missingInputs contains required items, ask the user instead of guessing values.",
+      "role": "integrator",
+      "resourceType": "datasource",
+      "steps": [
+        "GET section and inspect quality.missingInputs",
+        "If any entry has required true, collect answers from the user",
+        "Do not PATCH until required inputs are resolved or explicitly waived by policy"
+      ],
+      "relatedTopics": ["section", "workflow"]
+    },
+    {
+      "key": "subscription-role-scoping",
+      "title": "Scope subscriptions to business resource types",
+      "summary": "Align system.subscriptions filters with datasource resourceType tokens and role assistant scope.",
+      "role": "integrator",
+      "resourceType": "system",
+      "steps": [
+        "Read topic subscriptionGuide and section system.subscriptions",
+        "Ensure each datasource uses a business resourceType, not a generic placeholder",
+        "Set subscriptionFilter roleKeys and resourceTypes to match certified datasources",
+        "Validate after patch; run test when subscriptions trigger tasks"
+      ],
+      "relatedTopics": ["subscriptionGuide", "section", "goldenExample"]
+    },
+    {
+      "key": "multi-datasource-foreign-keys",
+      "title": "Link related datasources with foreignKeys",
+      "summary": "Declare foreignKeys when a document or child datasource depends on a CRM or record datasource.",
+      "role": "integrator",
+      "resourceType": "datasource",
+      "steps": [
+        "Identify parent record datasource key and child library or detail datasource",
+        "PATCH datasource.foreignKeys with intent describing the relationship",
+        "Repair expose and rbac if exposure profiles change",
+        "Validate both datasources and run integration test"
+      ],
+      "relatedTopics": ["goldenExample", "dependencyGraph", "repairRules"]
+    },
+    {
+      "key": "protection-dimension-gate",
+      "title": "Add protection after dimensions exist",
+      "summary": "Configure datasource.protection only after dimensions and metadata are stable.",
+      "role": "security-governance",
+      "resourceType": "datasource",
+      "steps": [
+        "Complete datasource.metadata and datasource.dimensions sections",
+        "PATCH datasource.protection with intent referencing dimension keys",
+        "Validate governance expectations before certify or upload",
+        "Document evidence that protection rules were reviewed with the user"
+      ],
+      "relatedTopics": ["section", "evidencePatterns", "validate-test-gate"]
+    },
+    {
+      "key": "platform-rbac-facade",
+      "title": "Use platform RBAC for facade APIs",
+      "summary": "Orchestration facade systems should use rbacPreset platform and dataplane platform roles, not per-system admin/reader.",
+      "role": "integrator",
+      "resourceType": "system",
+      "steps": [
+        "GET help topic platformRoles before patching system.rolesPermissions",
+        "Run repair with rbacPreset platform and rbac true",
+        "Confirm rbac.json role values match aifabrix-platform-admin through external-system-discoverer",
+        "Challenge any {systemKey}-admin or {systemKey}-reader entries"
+      ],
+      "relatedTopics": ["platformRoles", "repairRules", "workflow"]
+    },
+    {
+      "key": "resource-type-challenge",
+      "title": "Challenge resourceType catalog fit",
+      "summary": "Pick catalog resourceType keys that match business semantics; challenge generic document on CRM entities.",
+      "role": "integrator",
+      "resourceType": "datasource",
+      "steps": [
+        "GET help topic resourceTypeCatalog filtered by category when unsure",
+        "Compare datasource purpose to catalog description and defaultRiskLevel",
+        "Ask the user when two catalog keys could apply",
+        "Set entityType none orchestration datasources to workspace for facade APIs"
+      ],
+      "relatedTopics": ["resourceTypeCatalog", "schemaCatalog", "section"]
+    },
+    {
+      "key": "dimension-challenge-gate",
+      "title": "Challenge missing dimensions before protection",
+      "summary": "Ask for country, owner, sensitivity, or site dimensions before protection or subscription patches.",
+      "role": "security-governance",
+      "resourceType": "datasource",
+      "steps": [
+        "Read topic dimensionsGuide",
+        "Skip dimensions on entityType none orchestration datasources",
+        "List missing dimension keys and ask the user for business context",
+        "PATCH datasource.dimensions only after user confirms"
+      ],
+      "relatedTopics": ["dimensionsGuide", "protection-dimension-gate", "section"]
+    },
+    {
+      "key": "channel-onboarding-from-worklist",
+      "title": "Onboard channel from workspace work list",
+      "summary": "List workspace systems, publish integration, then scaffold assistant channel target.",
+      "role": "operator",
+      "resourceType": "system",
+      "steps": [
+        "GET help topic channelOnboarding",
+        "GET workspaces/me/systems to list draft systems",
+        "Validate and upload target systemKey",
+        "Guide user through channel scaffold and channel add for chosen target"
+      ],
+      "relatedTopics": ["channelOnboarding", "workflow", "connectedSystemUi"]
+    }
+  ]
+}

package/docs/builder-help/golden-examples/crm-company.json

@@ -0,0 +1,30 @@
+{
+  "key": "crm-company",
+  "title": "CRM company record",
+  "summary": "Metadata-first CRM company datasource with graph-ordered repair through field mappings and exposure.",
+  "resourceType": "crm",
+  "role": "integrator",
+  "roleAssistantExamples": ["Sales Assistant", "Data Quality Assistant"],
+  "recommendedSectionKeys": [
+    "datasource.metadata",
+    "datasource.fieldMappings",
+    "datasource.openapiOperations",
+    "datasource.mcpOperations"
+  ],
+  "subscriptionGuidance": "Add system.subscriptions when record events should spawn role assistant tasks. Scope resourceTypes to company, not generic document tokens.",
+  "qualityScoreFloor": 70,
+  "metadataTraversal": [
+    "datasource.fieldMappings",
+    "datasource.exposedAttributes",
+    "datasource.openapiOperations",
+    "datasource.mcpOperations",
+    "system.rolesPermissions"
+  ],
+  "sectionSnapshots": {
+    "datasource.entityType": "recordStorage",
+    "datasource.resourceType": "company",
+    "datasource.primaryKey": ["companyName"],
+    "datasource.metadataSchema.properties": ["companyName", "country"],
+    "datasource.capabilities": ["list", "get", "update"]
+  }
+}

package/docs/builder-help/golden-examples/crm-deal.json

@@ -0,0 +1,29 @@
+{
+  "key": "crm-deal",
+  "title": "CRM deal pipeline",
+  "summary": "Deal entity pattern with metadata traversal through mappings, exposure, and RBAC-derived sections.",
+  "resourceType": "crm",
+  "role": "integrator",
+  "roleAssistantExamples": ["Sales Assistant"],
+  "recommendedSectionKeys": [
+    "datasource.metadata",
+    "datasource.fieldMappings",
+    "datasource.capabilities",
+    "datasource.foreignKeys"
+  ],
+  "subscriptionGuidance": "Use subscriptions on deal status transitions. Align resourceTypes with deal on the datasource and in subscription filters.",
+  "qualityScoreFloor": 70,
+  "metadataTraversal": [
+    "datasource.fieldMappings",
+    "datasource.exposedAttributes",
+    "datasource.openapiOperations",
+    "datasource.mcpOperations",
+    "system.rolesPermissions"
+  ],
+  "sectionSnapshots": {
+    "datasource.entityType": "recordStorage",
+    "datasource.resourceType": "deal",
+    "datasource.capabilities": ["list", "get", "create", "update"],
+    "datasource.foreignKeys": "Link to company datasource when deals belong to accounts"
+  }
+}

package/docs/builder-help/golden-examples/document-storage-keyed-get.json

@@ -0,0 +1,85 @@
+{
+  "key": "document-storage-keyed-get",
+  "title": "Keyed document retrieval",
+  "summary": "Retrieve and persist one vendor file by business key without a list operation.",
+  "resourceType": "document",
+  "role": "integrator",
+  "roleAssistantExamples": [
+    "Sales Assistant",
+    "Project Assistant"
+  ],
+  "recommendedSectionKeys": [
+    "datasource.metadata",
+    "datasource.fieldMappings",
+    "datasource.exposedAttributes",
+    "datasource.sync",
+    "datasource.foreignKeys"
+  ],
+  "subscriptionGuidance": "Use a business resourceType on deal-linked libraries. Declare foreignKeys to the owning record datasource. Avoid generic document resourceTypes on role assistant filters.",
+  "qualityScoreFloor": 70,
+  "metadataTraversal": [
+    "datasource.fieldMappings",
+    "datasource.exposedAttributes",
+    "datasource.openapiOperations",
+    "datasource.mcpOperations",
+    "system.rolesPermissions"
+  ],
+  "sectionSnapshots": {
+    "datasource.entityType": "documentStorage",
+    "datasource.capabilities": [
+      { "key": "get" }
+    ],
+    "datasource.documentStorage": {
+      "enabled": true,
+      "binaryOperationRef": "get",
+      "responseType": "binary",
+      "ingestAfterSync": true
+    },
+    "datasource.execution": {
+      "engine": "cip",
+      "cip": {
+        "version": "1.0",
+        "operations": {
+          "get": {
+            "steps": [
+              {
+                "fetch": {
+                  "source": "openapi",
+                  "openapiRef": "get",
+                  "responseType": "binary"
+                }
+              },
+              {
+                "map": {
+                  "useFieldMappings": true
+                }
+              },
+              {
+                "filter": {
+                  "abac": {
+                    "mode": "mandatory"
+                  }
+                }
+              },
+              {
+                "output": {
+                  "mode": "documents"
+                }
+              }
+            ]
+          }
+        }
+      }
+    },
+    "datasource.fieldMappings": {
+      "attributes": {
+        "documentId": {
+          "expression": "{{raw.params.DocumentId}}"
+        },
+        "filename": {
+          "expression": "{{raw.headers.FileName}}"
+        }
+      }
+    }
+  }
+}

package/docs/builder-help/golden-examples/document-storage.json

@@ -0,0 +1,30 @@
+{
+  "key": "document-storage",
+  "title": "Document storage entity",
+  "summary": "File or document metadata pattern with exposure and OpenAPI operation derivation.",
+  "resourceType": "document",
+  "role": "integrator",
+  "roleAssistantExamples": ["Sales Assistant", "Project Assistant"],
+  "recommendedSectionKeys": [
+    "datasource.metadata",
+    "datasource.fieldMappings",
+    "datasource.exposedAttributes",
+    "datasource.sync",
+    "datasource.foreignKeys"
+  ],
+  "subscriptionGuidance": "Use a business resourceType on deal-linked libraries. Declare foreignKeys to the owning record datasource. Avoid generic document resourceTypes on role assistant filters.",
+  "qualityScoreFloor": 70,
+  "metadataTraversal": [
+    "datasource.fieldMappings",
+    "datasource.exposedAttributes",
+    "datasource.openapiOperations",
+    "datasource.mcpOperations",
+    "system.rolesPermissions"
+  ],
+  "sectionSnapshots": {
+    "datasource.entityType": "documentStorage",
+    "datasource.resourceType": "deal",
+    "datasource.documentStorage": "binaryOperationRef and sync profile required for RAG",
+    "datasource.foreignKeys": "Target CRM deal datasource key"
+  }
+}

package/docs/builder-help/golden-examples/meeting-transcript.json

@@ -0,0 +1,29 @@
+{
+  "key": "meeting-transcript",
+  "title": "Meeting transcript capture",
+  "summary": "Transcript or conversation entity with metadata and capability-driven operation exposure.",
+  "resourceType": "transcript",
+  "role": "integrator",
+  "roleAssistantExamples": ["Sales Assistant", "Project Assistant"],
+  "recommendedSectionKeys": [
+    "datasource.metadata",
+    "datasource.capabilities",
+    "datasource.openapiOperations",
+    "datasource.execution"
+  ],
+  "subscriptionGuidance": "Optional subscriptions on transcript ingest for meeting capture assistants. Keep resourceTypes aligned to transcript or meeting tokens.",
+  "qualityScoreFloor": 70,
+  "metadataTraversal": [
+    "datasource.fieldMappings",
+    "datasource.exposedAttributes",
+    "datasource.openapiOperations",
+    "datasource.mcpOperations",
+    "system.rolesPermissions"
+  ],
+  "sectionSnapshots": {
+    "datasource.entityType": "recordStorage",
+    "datasource.resourceType": "meetingTranscript",
+    "datasource.execution.engine": "cip",
+    "datasource.capabilities": ["list", "get", "create"]
+  }
+}

package/docs/builder-help/golden-examples/repository-template.json

@@ -0,0 +1,29 @@
+{
+  "key": "repository-template",
+  "title": "Repository template workspace",
+  "summary": "Template-backed integration pattern for repository sync and lifecycle tooling.",
+  "resourceType": "repository",
+  "role": "devops",
+  "roleAssistantExamples": ["Project Assistant"],
+  "recommendedSectionKeys": [
+    "system.basics",
+    "system.kind",
+    "datasource.metadata",
+    "datasource.sync",
+    "system.lifecycle"
+  ],
+  "subscriptionGuidance": "Subscriptions are optional for repository-driven generation. Prefer lifecycle and template materialize flows before event subscriptions.",
+  "qualityScoreFloor": 70,
+  "metadataTraversal": [
+    "datasource.fieldMappings",
+    "datasource.exposedAttributes",
+    "datasource.openapiOperations",
+    "datasource.mcpOperations",
+    "system.rolesPermissions"
+  ],
+  "sectionSnapshots": {
+    "system.kind": "repository or enterpriseContext variant",
+    "datasource.sync": "Pull or push strategy declared explicitly",
+    "system.lifecycle": "Certification and publish gates before production"
+  }
+}

package/docs/builder-help/golden-examples/service-ticket.json

@@ -0,0 +1,29 @@
+{
+  "key": "service-ticket",
+  "title": "Service ticket entity",
+  "summary": "Support or service ticket pattern with metadata, mappings, and governance sections.",
+  "resourceType": "ticket",
+  "role": "integrator",
+  "roleAssistantExamples": ["Customer Success Assistant", "Data Quality Assistant"],
+  "recommendedSectionKeys": [
+    "datasource.metadata",
+    "datasource.fieldMappings",
+    "datasource.governance",
+    "datasource.protection"
+  ],
+  "subscriptionGuidance": "Subscriptions on ticket status changes can drive Customer Success assistant tasks. Pair with governance and protection sections for sensitive fields.",
+  "qualityScoreFloor": 70,
+  "metadataTraversal": [
+    "datasource.fieldMappings",
+    "datasource.exposedAttributes",
+    "datasource.openapiOperations",
+    "datasource.mcpOperations",
+    "system.rolesPermissions"
+  ],
+  "sectionSnapshots": {
+    "datasource.entityType": "recordStorage",
+    "datasource.resourceType": "serviceTicket",
+    "datasource.governance": "Approval or retention hints when required",
+    "datasource.protection": "Dimension-scoped rules for priority or region"
+  }
+}

package/docs/builder-help/platform-roles.json

@@ -0,0 +1,98 @@
+{
+  "schemaVersion": "1.0.0",
+  "source": "builder/dataplane/rbac.yaml roles block",
+  "lastSynced": "2026-08-19",
+  "roles": [
+    {
+      "name": "Platform Admin",
+      "value": "aifabrix-platform-admin",
+      "description": "Full platform infrastructure management and enterprise controller access",
+      "groups": ["AI-Fabrix-Platform-Admins"]
+    },
+    {
+      "name": "Security Admin",
+      "value": "aifabrix-security-admin",
+      "description": "Security and compliance management for enterprise controller",
+      "groups": ["AI-Fabrix-Security-Admins"]
+    },
+    {
+      "name": "Deployment Admin",
+      "value": "aifabrix-deployment-admin",
+      "description": "Application deployment orchestration and environment management",
+      "groups": ["AI-Fabrix-Deployment-Admins"]
+    },
+    {
+      "name": "Compliance Admin",
+      "value": "aifabrix-compliance-admin",
+      "description": "ISO 27001 compliance monitoring and audit management",
+      "groups": ["AI-Fabrix-Compliance-Admins"]
+    },
+    {
+      "name": "Developer",
+      "value": "aifabrix-developer",
+      "description": "Developer access to deploy applications via CI pipelines",
+      "groups": ["AI-Fabrix-Developers"]
+    },
+    {
+      "name": "Observer",
+      "value": "aifabrix-observer",
+      "description": "Read-only access to monitoring, logs, and compliance reports",
+      "groups": ["AI-Fabrix-Observers"]
+    },
+    {
+      "name": "AI Trust Operator",
+      "value": "aifabrix-ai-trust-operator",
+      "description": "Run AI Trust access evaluation and explain visibility for governed users",
+      "groups": ["AI-Fabrix-AI-Trust-Operators"]
+    },
+    {
+      "name": "External System Discoverer",
+      "value": "aifabrix-external-system-discoverer",
+      "description": "Discover business context for external systems via REST and MCP",
+      "groups": ["AI-Fabrix-External-System-Discoverers"]
+    }
+  ],
+  "permissionMatrix": [
+    {
+      "operationClass": "read",
+      "operationTypeHints": ["*.read", "help.read", "infra"],
+      "roles": [
+        "aifabrix-observer",
+        "aifabrix-external-system-discoverer",
+        "aifabrix-developer",
+        "aifabrix-deployment-admin",
+        "aifabrix-platform-admin"
+      ]
+    },
+    {
+      "operationClass": "plan",
+      "operationTypeHints": ["plan", "template"],
+      "roles": ["aifabrix-developer", "aifabrix-deployment-admin", "aifabrix-platform-admin"]
+    },
+    {
+      "operationClass": "validate",
+      "operationTypeHints": ["validate", "test"],
+      "roles": ["aifabrix-developer", "aifabrix-deployment-admin", "aifabrix-platform-admin"]
+    },
+    {
+      "operationClass": "apply",
+      "operationTypeHints": ["apply.dev"],
+      "roles": ["aifabrix-deployment-admin", "aifabrix-platform-admin"]
+    },
+    {
+      "operationClass": "certify",
+      "operationTypeHints": ["certify", "certify.read"],
+      "roles": [
+        "aifabrix-security-admin",
+        "aifabrix-compliance-admin",
+        "aifabrix-ai-trust-operator",
+        "aifabrix-platform-admin"
+      ]
+    },
+    {
+      "operationClass": "repository",
+      "operationTypeHints": ["repository", "repository.read"],
+      "roles": ["aifabrix-developer", "aifabrix-deployment-admin", "aifabrix-platform-admin"]
+    }
+  ]
+}