@domesystems/templates 0.1.0

package/README.md

@@ -0,0 +1,168 @@
+# Dome templates
+
+Reusable, importable governed-agent templates. Each template combines an HCL
+configuration bundle for Dome with an optional companion application.
+
+## Use the template CLI
+
+The public package is also an executable. It copies the template, creates a
+local `.env` from `.env.example`, and generates the Compose file from the
+runtime declaration in `template.yaml` — individual templates do not need a
+Dockerfile or a committed Compose file.
+
+```bash
+# Create a working copy in ./ai-agent-for-documentation.
+npx @domesystems/templates init ai-agent-for-documentation
+
+# Initialize when needed, provision Dome, then start the selected runtime.
+npx @domesystems/templates up ai-agent-for-documentation
+```
+
+`up` runs `dome import dome.tf`, then `docker compose` with a generated,
+Git-ignored `.dome-compose.yaml`. Use `--no-start` to provision without
+starting a container, `--skip-provision` to start an already-provisioned
+template, `--detach` for a background container, and `--dir <directory>` to
+choose a local destination.
+
+Runtime selection is explicit rather than guessed:
+
+```yaml
+app:
+  runtime:
+    pattern: chat         # chat or run
+    language: python      # python or typescript
+    image_tag: "0.1.0"    # optional; defaults to latest
+```
+
+The CLI maps `language` and `pattern` to a shared, published runtime image.
+For an unusual runtime, set `app.runtime.image` to a complete image reference
+(including its tag) to override that mapping.
+Add a template directory to the package's `files` list when publishing a new
+template so the CLI can discover it.
+
+## Use a template
+
+```bash
+git clone https://github.com/dome-systems/templates.git
+cd templates/<template>
+
+brew install dome-systems/tap/dome
+dome auth login
+dome sandbox provision
+
+# Preview resources, variables, and required permissions. Changes nothing.
+dome import dome.tf --plan-only
+
+# Apply after reviewing the preview. Dome prompts for required variables.
+dome import dome.tf
+```
+
+Imports run as asynchronous jobs in Dome. Existing resources are converged by
+name, missing resources are created, and any destructive replacement is
+refused. Secrets are input variables: they are never committed to a template
+or returned in an export.
+
+Every built companion app needs the one-time agent token created by the import:
+
+```bash
+dome import outputs <job-id>
+cp .env.example .env
+docker compose up
+```
+
+Tool and model credentials remain in Dome; the app only holds its agent token.
+
+### Runtime image
+
+Templates do not build a runtime themselves. In development, clone the sibling
+`dome-systems/template-runtime` repository and build the archetype image before
+starting a template:
+
+```bash
+cd template-runtime
+docker build -f Dockerfile.chat -t ghcr.io/dome-systems/runtime-py-chat:dev .
+docker build -f Dockerfile.run -t ghcr.io/dome-systems/runtime-py-run:dev .
+```
+
+TypeScript equivalents are available as `ghcr.io/dome-systems/runtime-ts-chat`
+and `ghcr.io/dome-systems/runtime-ts-run`; substitute either image in a template's Compose file
+when using the Node runtime.
+
+The CLI-generated Compose configuration uses the appropriate image and mounts
+only the template's local `app/` configuration. Release templates should set a
+versioned `app.runtime.image_tag` rather than relying on `latest`.
+
+## Runtime contract
+
+Every built companion app follows the same small operational contract:
+
+| Surface | Guarantee |
+|---|---|
+| `.env.example` | The complete committed list of values a local operator may need. It contains names and setup guidance, never real values. |
+| `docker-compose.yml` | Starts the app on port `3000`, loads `.env`, mounts `app/` read-only, and declares the health check. |
+| `GET /health` | Liveness only: returns `200 {"status":"ok"}` without calling Dome or an upstream system. Offline mode is valid. `/healthz` is an equivalent compatibility alias. |
+| `GET /readyz` | Readiness of the initialized runtime API. Returns `200`; its `mode` is `live` or `offline`. |
+| Docker `HEALTHCHECK` | Probes `/health`; inherited by every shared runtime image and repeated in Compose for a visible local contract. |
+
+The Library renders each template's committed `.env.example` verbatim, so setup
+requirements have one source of truth. Add a new variable there when the
+companion app needs it; use `app.options.env` in `template.yaml` as well when
+that value is interpolated into an agent prompt, starter, or help text.
+
+## Archetype containers
+
+The separate `dome-systems/template-runtime` repository builds one image per app
+shape. They contain no template-specific code — a template mounts an
+`app/agent.yaml` giving its **prompt**, its **skills** and its **invoker**, which
+is the shape the Dome agent runtime will take, so swapping a container for the
+real runner is a config move rather than a rewrite.
+
+Four UIs cover all 249 templates. A report is a run whose output is a table; an approval
+console is a queue with two extra buttons.
+
+| Archetype | Covers | Shapes | State |
+|---|---|---|---|
+| `ghcr.io/dome-systems/runtime-py-chat` | 66 | interactive-assistant | Built |
+| `ghcr.io/dome-systems/runtime-py-run` | 120 | scheduled-job, report-dashboard | Built |
+| `dome/template-queue` | 48 | triage-queue, approval-console | Not built |
+| `dome/template-console` | 15 | external-service, developer-harness | Not built |
+
+The governance drawer is shared chrome across all four, not a per-archetype feature.
+
+Tools go through the Gateway over MCP; models go through the Broker's
+Anthropic-compatible ingress. Both authenticate with the same agent token, which is why
+the container holds one secret and no provider key. Without `DOME_TOKEN` it starts in
+offline mode: the chrome works and the allow-list is still enforced, but tools and model
+are simulated.
+
+## What is source and what is generated
+
+`dome.tf` is the configuration source of truth for Dome resources. It is a
+portable HCL bundle that `dome import` can inspect, preview, and apply.
+`template.yaml` is catalog metadata and the source of truth for choosing the
+shared local runtime; `rules/*.cedar` and `app/instructions.md` are
+human-authored source.
+
+## Relationship to the Template Library
+
+This repository is the Library's only template-content source. A merge to `main`
+dispatches its commit SHA to `dome-systems/web-library`; that repository checks out
+and builds the exact revision, then opens or updates one source-refresh PR. The
+Library does not copy or edit template content, and a refresh PR must be merged
+before the new source can be published.
+
+The dispatch uses the `LIBRARY_SOURCE_SYNC_TOKEN` repository secret. It needs a
+fine-grained token that may dispatch workflows in `dome-systems/web-library`.
+
+## Validation
+
+Run the metadata and source-reference checks locally:
+
+```bash
+npm install
+npm run validate
+terraform fmt -check -recursive
+```
+
+CI runs the same checks. A plan-only import against a designated Dome sandbox can
+be added when CI has an appropriate non-production workspace and credentials.

package/ai-agent-for-documentation/.env.example

@@ -0,0 +1,12 @@
+# The container holds exactly one secret.
+#
+# Tool credentials went into Dome when dome import ran and live behind the gateway.
+# The provider key lives with the Broker. Neither is here, and neither should be.
+
+# Revealed once after import: dome import outputs <job-id>
+DOME_TOKEN=
+
+# The gateway ROOT — not a bare host, and not the /mcp path.
+# Copy the "Gateway URL" from the command above. The container derives
+# /mcp for tools and /v1/messages for models from it.
+DOME_GATEWAY_URL=

package/ai-agent-for-documentation/app/agent.yaml

@@ -0,0 +1,31 @@
+name: docs-answerer
+title: Ask questions about product documentation
+summary: "A chat agent that answers questions from the Dome Platform documentation.\
+  \ Nothing to set up upstream \u2014 the documentation MCP server takes no credential,\
+  \ so this reaches a real system on the first run. The connection carries three tools.\
+  \ Two answer questions. The third returns the whole documentation index, and the\
+  \ agent will reach for it \u2014 Dome refuses, and names the rule that refused it."
+shape: interactive-assistant
+prompt_file: instructions.md
+help_file: help.md
+model: claude-haiku-4-5-20251001
+pool: docs-pool
+max_tokens: 4096
+skills:
+- name: answer-from-documentation
+  description: Search the documentation, read the most relevant pages, answer from
+    them.
+  tools:
+  - domedocs/search
+  - domedocs/get_page
+  - domedocs/list_pages
+invoker:
+  kind: chat
+options:
+  identity:
+    mode: none
+  model:
+    provider: anthropic
+    model: claude-haiku-4-5-20251001
+forbidden:
+- domedocs/list_pages

package/ai-agent-for-documentation/app/help.md

@@ -0,0 +1,19 @@
+Ask a question about the Dome Platform in plain language. The agent searches the
+public documentation at `docs.domesystems.ai`, reads the pages it finds, and
+answers from them.
+
+**Nothing to set up upstream.** The documentation MCP server takes no
+credential, so this template reaches a real system on its first run. The only
+key the workspace needs is a model provider key — every template needs one —
+and it goes to Dome, not into this container.
+
+**Ask something broad.** "What is Dome" or "what does the gateway do". The agent
+will reach for the documentation index to orient itself, that call will come
+back refused, and you will watch it fall back to search and answer anyway. The
+refusal is the rule, not the prompt.
+
+**Show detail** in the header opens the design: the topology, which tools are
+permitted, and the instructions the model was given.
+
+Nothing here is the record. Every call, allowed or refused, is in the audit log
+in Dome.

package/ai-agent-for-documentation/app/instructions.md

@@ -0,0 +1,21 @@
+You answer questions about the Dome Platform from its documentation.
+
+Work like this:
+
+1. If the question is broad — "what is Dome", "how does authorization work" —
+   start from the documentation index to see what exists.
+2. Search the documentation for the terms in the question. Search results carry
+   the path of every page they match.
+3. Read pages rather than searching repeatedly. Two or three searches is
+   plenty; after that, open the most promising pages in full **using the paths
+   the search results gave you**. Do not invent a path and try it.
+4. Answer from what you read, and name the pages you used.
+
+If the documentation does not contain the answer, say so plainly. Do not fill
+the gap from general knowledge — a confident answer that is not in the
+documentation is worse than no answer, because the reader cannot tell the
+difference.
+
+Use whatever tools you have been given, and do not decline a request on the
+assumption that you lack permission. If a call comes back refused, say what came
+back and carry on with the tools that do work.

package/ai-agent-for-documentation/docker-compose.yml

@@ -0,0 +1,18 @@
+#
+# Without DOME_TOKEN this starts in offline mode: the chrome works and the
+# allow-list is still enforced, but tools and model are simulated.
+services:
+  app:
+    # Built and published by dome-systems/template-runtime.
+    image: ghcr.io/dome-systems/runtime-py-chat:dev
+    env_file: .env
+    volumes:
+      - ./app:/config:ro
+    ports:
+      - "3000:3000"
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:3000/health', timeout=2)"]
+      interval: 30s
+      timeout: 3s
+      start_period: 10s
+      retries: 3

package/ai-agent-for-documentation/dome.tf

@@ -0,0 +1,146 @@
+terraform {
+  required_providers {
+    dome = { source = "dome-systems/dome", version = ">= 0.1.0" }
+  }
+}
+
+variable "workspace_id" { type = string }
+variable "anthropic_api_key" {
+  type      = string
+  sensitive = true
+}
+
+resource "dome_gateway" "docs" {
+  workspace_id = var.workspace_id
+  name         = "docs"
+  description  = "Read surface over the public Dome Platform documentation"
+  is_default   = true
+}
+
+resource "dome_mcp_connection" "domedocs" {
+  workspace_id = var.workspace_id
+  name         = "domedocs"
+  protocol     = "streamable-http"
+  url          = "https://docs.domesystems.ai/mcp"
+  auth_method  = "none"
+}
+
+resource "dome_llm_connection" "haiku" {
+  workspace_id        = var.workspace_id
+  name                = "haiku"
+  provider_id         = "anthropic"
+  provider_config     = jsonencode({ model = "claude-haiku-4-5-20251001" })
+  auth_method         = "api-key"
+  credential_type     = "shared"
+  managed_header_name = "x-api-key"
+  secret_values       = { "x-api-key" = var.anthropic_api_key }
+}
+
+resource "dome_llm_pool" "docs" {
+  workspace_id = var.workspace_id
+  name         = "docs-pool"
+  is_default   = true
+}
+
+resource "dome_llm_pool_member" "haiku" {
+  workspace_id   = var.workspace_id
+  pool           = dome_llm_pool.docs.name
+  llm_connection = dome_llm_connection.haiku.name
+}
+
+resource "dome_gateway_llm_pool" "docs" {
+  workspace_id = var.workspace_id
+  gateway      = dome_gateway.docs.name
+  llm_pool     = dome_llm_pool.docs.name
+}
+
+resource "dome_gateway_tool" "search" {
+  workspace_id   = var.workspace_id
+  gateway        = dome_gateway.docs.name
+  mcp_connection = dome_mcp_connection.domedocs.name
+  tool           = "search"
+}
+
+resource "dome_gateway_tool" "get_page" {
+  workspace_id   = var.workspace_id
+  gateway        = dome_gateway.docs.name
+  mcp_connection = dome_mcp_connection.domedocs.name
+  tool           = "get_page"
+}
+
+resource "dome_gateway_tool" "list_pages" {
+  workspace_id   = var.workspace_id
+  gateway        = dome_gateway.docs.name
+  mcp_connection = dome_mcp_connection.domedocs.name
+  tool           = "list_pages"
+}
+
+resource "dome_agent" "docs_answerer" {
+  workspace_id     = var.workspace_id
+  name             = "docs-answerer"
+  allowed_gateways = [dome_gateway.docs.name]
+}
+
+resource "dome_agent_rules_bundle" "docs_answerer" {
+  workspace_id = var.workspace_id
+  agent        = dome_agent.docs_answerer.name
+  files = {
+    "answerer.cedar" = <<-EOT
+      permit ( principal, action == Dome::Action::"mcp:discover", resource );
+      permit ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"domedocs/search" );
+      permit ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"domedocs/get_page" );
+      forbid ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"domedocs/list_pages" );
+    EOT
+  }
+}
+
+resource "dome_filter" "keep_ssn_out_of_prompts" {
+  workspace_id = var.workspace_id
+  name         = "keep-ssn-out-of-prompts"
+  description  = "Redact US SSN patterns out of anything sent to the provider"
+  config = jsonencode({
+    text = { components = [{ action = "FILTER_ACTION_REDACT", matchers = [{ ssn = {} }] }] }
+  })
+}
+
+resource "dome_llm_connection_filters" "haiku_requests" {
+  workspace_id   = var.workspace_id
+  llm_connection = dome_llm_connection.haiku.name
+  direction      = "request"
+  filters        = [dome_filter.keep_ssn_out_of_prompts.name]
+}
+
+resource "dome_quota" "agent_daily_spend" {
+  workspace_id = var.workspace_id
+  dimension    = "llm"
+  unit         = "dome_usd"
+  subject_type = "agent"
+  subject      = dome_agent.docs_answerer.name
+  scope        = "total"
+  window       = "daily"
+  limit_amount = 5000000
+  name         = "docs-answerer daily spend"
+}
+
+resource "dome_quota" "search_calls" {
+  workspace_id = var.workspace_id
+  dimension    = "tool"
+  unit         = "calls"
+  subject_type = "tool_connection"
+  subject      = dome_mcp_connection.domedocs.name
+  scope        = "total"
+  window       = "daily"
+  limit_amount = 500
+  name         = "domedocs search calls"
+}
+
+resource "dome_agent_key" "runtime" {
+  workspace_id = var.workspace_id
+  agent        = dome_agent.docs_answerer.name
+  name         = "runtime"
+}
+
+output "docs_answerer_token" {
+  value     = dome_agent_key.runtime.token
+  sensitive = true
+}

package/ai-agent-for-documentation/rules/answerer.cedar

@@ -0,0 +1,35 @@
+// answer-from-dome-docs — authorization rules
+//
+// The documentation MCP server is read-only upstream: there is no write tool to
+// forbid here, so the boundary this template demonstrates is the allow-list
+// itself. `search` and `get_page` are what answering a question needs.
+// `list_pages` returns the entire documentation index — the call an agent makes
+// to enumerate a corpus rather than to answer about it — so it is on the
+// gateway, visible to the model, and denied.
+//
+// The write-boundary version of this story is
+// ai-agent-for-notion, where a Notion page-creation tool is
+// reachable and refused.
+
+permit ( principal, action == Dome::Action::"mcp:discover", resource );
+
+permit (
+  principal,
+  action == Dome::Action::"mcp:call",
+  resource == Dome::MCPTool::"domedocs/search"
+);
+
+permit (
+  principal,
+  action == Dome::Action::"mcp:call",
+  resource == Dome::MCPTool::"domedocs/get_page"
+);
+
+// Registering an agent against a gateway auto-generates an Agent Form policy
+// permitting any tool whose `gateways` attribute contains that gateway. A
+// permit cannot narrow that; only a forbid can. Cedar forbid always wins.
+forbid (
+  principal,
+  action == Dome::Action::"mcp:call",
+  resource == Dome::MCPTool::"domedocs/list_pages"
+);

package/ai-agent-for-documentation/template.yaml

@@ -0,0 +1,130 @@
+apiVersion: templates.domesystems.ai/v1
+kind: Template
+
+metadata:
+  name: answer-from-dome-docs
+  slug: ai-agent-for-documentation
+  title: Ask questions about product documentation
+  target_query: ai chatbot for documentation
+  summary: >-
+    A chat agent that answers questions from the Dome Platform documentation.
+    Nothing to set up upstream — the documentation MCP server takes no
+    credential, so this reaches a real system on the first run. The connection
+    carries three tools. Two answer questions. The third returns the whole
+    documentation index, and the agent will reach for it — Dome refuses, and
+    names the rule that refused it.
+  domain: productivity
+  shape: interactive-assistant
+  ui: chat
+  business_pattern: consumes
+  governance_interest: [read-only, tool-scoped-access]
+
+# Library-only topology and documentation data. `dome.tf` is the deployable source.
+catalog:
+  gateway:
+    name: docs
+    description: Read surface over the public Dome Platform documentation
+    default: true
+
+  connections:
+    - name: domedocs
+      protocol: streamable-http
+      url: https://docs.domesystems.ai/mcp
+      # The whole point of this template. A public MCP server, no token, no
+      # consent screen, no account to create upstream.
+      auth:
+        method: none
+      permit:
+        - search
+        - get_page
+      # On the gateway on purpose, so the model can see it and try. Cedar
+      # forbids it, and a forbid beats the auto-generated Agent Form permit.
+      # Without this there is no denial to observe.
+      forbid:
+        - list_pages
+
+  model:
+    name: haiku
+    provider: anthropic
+    model_id: claude-haiku-4-5-20251001
+    secret:
+      env: ANTHROPIC_API_KEY
+      variable: anthropic_api_key
+      label: an Anthropic API key
+
+  pool:
+    name: docs-pool
+    default: true
+
+  agent:
+    name: docs-answerer
+    # No identity. This template's governance story is the allow-list, and
+    # act-as would add a second secret to the one thing in the library that
+    # needs none. The caller-scoped story is answer-from-knowledge-base.
+    act_as:
+      method: none
+
+  rules:
+    file: rules/answerer.cedar
+
+  # A text filter on the *model* request. Whatever a person types into the box
+  # goes to a provider, and this is the cheapest true statement a template can
+  # make: an SSN never reaches Anthropic. Text-kind, so it binds to the model
+  # connection — a tool connection would refuse it.
+  guards:
+    filters:
+      - name: keep-ssn-out-of-prompts
+        description: Redact US SSN patterns out of anything sent to the provider
+        why: >-
+          Whatever a person types into the box goes to a provider. This is the
+          cheapest true thing a template can claim — an SSN never reaches
+          Anthropic — and it costs one line because the credential and the
+          routing already live in Dome. Text-kind, so it binds to the model
+          connection; a tool connection refuses a text filter outright.
+        redact_ssn: true
+        bind: { model: haiku, direction: request }
+
+  quotas:
+    # What the agent may spend with Dome, per day.
+    - subject: agent
+      agent: docs-answerer
+      unit: dome_usd
+      limit: 5
+      window: daily
+      name: docs-answerer daily spend
+    # And a call ceiling on the one tool that does the work. The docs server is
+    # public and someone else pays for it, so not hammering it is part of using
+    # it politely — a rate limit with a reason, rather than a round number.
+    - subject: tool
+      tool: domedocs/search
+      unit: calls
+      limit: 500
+      window: daily
+      name: domedocs search calls
+
+app:
+  runtime:
+    pattern: chat
+    language: python
+  agent:
+    prompt: app/instructions.md
+    help: app/help.md
+    model: claude-haiku-4-5-20251001
+    # 2048 truncates a documentation answer mid-sentence, and a truncated turn
+    # loses the tool call it was half-way through writing.
+    max_tokens: 4096
+    skills:
+      - name: answer-from-documentation
+        description: Search the documentation, read the most relevant pages, answer from them.
+        tools:
+          - domedocs/search
+          - domedocs/get_page
+          - domedocs/list_pages
+    invoker:
+      kind: chat
+  options:
+    identity:
+      mode: none
+    model:
+      provider: anthropic
+      model: claude-haiku-4-5-20251001

package/ai-agent-for-documentation/verification.json

@@ -0,0 +1,7 @@
+{
+  "verified": "2026-09-12T19:25:26Z",
+  "context": "api-domesystems-ai-dome-systems-core-dome-library",
+  "gateway": "docs",
+  "agent": "docs-answerer",
+  "cli": "1.0.2"
+}

package/ai-agent-for-notion/.env.example

@@ -0,0 +1,19 @@
+# The container holds exactly one secret.
+#
+# Tool credentials went into Dome when dome import ran and live behind the gateway.
+# The provider key lives with the Broker. Neither is here, and neither should be.
+
+# Revealed once after import: dome import outputs <job-id>
+DOME_TOKEN=
+
+# The gateway ROOT — not a bare host, and not the /mcp path.
+# Copy the "Gateway URL" from the command above. The container derives
+# /mcp for tools and /v1/messages for models from it.
+DOME_GATEWAY_URL=
+
+# The second secret, and the only one an identity-enabled blueprint adds.
+# The container signs the act-as header with it; the gateway verifies the
+# signature before it will believe who the request claims to be. Without
+# that, anyone holding the agent token could claim to be anyone.
+# Must match the actas_hmac_secret supplied to dome import.
+ACTAS_HMAC_SECRET=

package/ai-agent-for-notion/app/agent.yaml

@@ -0,0 +1,32 @@
+name: knowledge-answerer
+title: Ask questions across your Notion workspace
+summary: "A chat agent that answers questions from your Notion workspace. The connection\
+  \ carries 43 tools, twenty-odd of which write. Two are permitted. Ask it to create\
+  \ a page and it will try \u2014 and Dome will refuse, naming the rule that refused\
+  \ it."
+shape: interactive-assistant
+prompt_file: instructions.md
+help_file: help.md
+model: claude-sonnet-5
+pool: answerer-pool
+max_tokens: 2048
+skills:
+- name: answer-from-notion
+  description: Search the workspace, read the most relevant pages, answer from them.
+  tools:
+  - notion/notion-search
+  - notion/notion-fetch
+  - notion/notion-create-pages
+invoker:
+  kind: chat
+options:
+  identity:
+    mode: oidc-stub
+    personas:
+    - id: alice
+    - id: bob
+  model:
+    provider: anthropic
+    model: claude-sonnet-5
+forbidden:
+- notion/notion-create-pages

package/ai-agent-for-notion/app/help.md

@@ -0,0 +1,14 @@
+Ask a question in plain language. The agent searches the connected Notion
+workspace, reads the pages it finds, and answers from them.
+
+**Show detail** in the header opens the design: the topology, which tools are
+permitted, and the instructions the model was given.
+
+**Try changing who is asking.** Alice is permitted. Bob is not, and the same
+question comes back refused — the difference is the rule, not the wording.
+
+**Ask it to create a page.** It will try, and the attempt will be blocked. The
+connection carries 43 Notion tools; two are permitted.
+
+Nothing here is the record. Every call, allowed or refused, is in the audit log
+in Dome.

package/ai-agent-for-notion/app/instructions.md

@@ -0,0 +1,16 @@
+You answer questions using the connected Notion workspace.
+
+Work like this:
+
+1. Search Notion for pages relevant to the question.
+2. Fetch the most promising two or three and read them.
+3. Answer from what you found, and name the pages you used.
+
+If the workspace does not contain the answer, say so plainly. Do not fill the
+gap from general knowledge — a confident answer that is not in the
+documentation is worse than no answer, because the reader cannot tell the
+difference.
+
+Use whatever tools you have been given, and do not decline a request on the
+assumption that you lack permission. If an action is not allowed, attempting it
+is how you and the person asking find that out; report what came back.