@vellumai/assistant 0.8.6 → 0.8.7

package/src/runtime/routes/migration-rollback-routes.ts

@@ -19,6 +19,7 @@ import {
   loadCheckpoints,
   rollbackWorkspaceMigrations,
 } from "../../workspace/migrations/runner.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -160,11 +161,14 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "admin_rollbackmigrations_post",
     endpoint: "admin/rollback-migrations",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Rollback migrations",
     description:
       "Roll back DB and/or workspace migrations to a specified target version. Restricted to gateway service principals.",
     tags: ["admin"],
-    requirePolicyEnforcement: true,
     handler: handleRollbackMigrations,
     requestBody: z.object({
       targetDbVersion: z

package/src/runtime/routes/migration-routes.ts

@@ -41,6 +41,7 @@ import { getLogger } from "../../util/logger.js";
 import { getWorkspaceDir, getWorkspaceHooksDir } from "../../util/platform.js";
 import { APP_VERSION } from "../../version.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   validateGcsSignedUrl,
   type ValidateGcsSignedUrlOptions,
@@ -1852,6 +1853,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_validate_post",
     endpoint: "migrations/validate",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Validate a .vbundle archive",
     description:
       "Upload a .vbundle archive for validation. Accepts raw binary or multipart form data.",
@@ -1867,6 +1872,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_export_post",
     endpoint: "migrations/export",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Export a .vbundle archive",
     description:
       "Generate and download a .vbundle archive of the assistant's data. Optional JSON body for metadata.",
@@ -1880,6 +1889,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_importpreflight_post",
     endpoint: "migrations/import-preflight",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Dry-run import analysis",
     description:
       "Validate a .vbundle archive and return a report of what would change on import without modifying data.",
@@ -1897,6 +1910,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_import_post",
     endpoint: "migrations/import",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Import a .vbundle archive",
     description:
       "Commit a .vbundle archive import to disk — destructive. Accepts the bundle as raw bytes (application/octet-stream), multipart/form-data, or a JSON body with `{ url }` carrying a signed URL the daemon fetches.",
@@ -1927,6 +1944,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_exporttogcs_post",
     endpoint: "migrations/export-to-gcs",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Start an async export streamed to a GCS signed URL",
     description:
       "Kick off a background export job that PUTs a freshly-built .vbundle archive to the supplied GCS signed URL. Returns 202 with a job_id the caller can poll via the job-status endpoint. Fails fast with 409 if another export job is already pending or running.",
@@ -1953,6 +1974,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_importfromgcs_post",
     endpoint: "migrations/import-from-gcs",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Start an async .vbundle import from a signed GCS URL",
     description:
       "Schedule a background import job that fetches the bundle at `bundle_url` and streams it through the importer. Returns 202 with a `job_id`; poll `GET /v1/migrations/jobs/{job_id}` for status. 409 if another import is already in flight.",
@@ -1977,6 +2002,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_jobs_by_job_id_get",
     endpoint: "migrations/jobs/:job_id",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get migration job status",
     description:
       "Return the current status of an async migration job (export or import). The response discriminates on `status`: `processing` (pending or running), `complete` (with `result`), or `failed` (with `error`, `error_code`, optional `upstream_status`).",

package/src/runtime/routes/notification-routes.ts

@@ -12,6 +12,7 @@ import { editNotification } from "../../notifications/edit-notification.js";
 import { emitNotificationSignal } from "../../notifications/emit-signal.js";
 import { listEvents } from "../../notifications/events-store.js";
 import type { AttentionHints } from "../../notifications/signal.js";
+import { ACTOR_PRINCIPALS, LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -196,6 +197,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "emit_notification_signal",
     endpoint: "notifications/emit",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEmitSignal,
     summary: "Emit a notification signal",
     description:
@@ -213,6 +218,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "edit_notification",
     endpoint: "notifications/edit",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEditNotification,
     summary: "Edit an already-sent notification",
     description:
@@ -241,6 +250,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "list_notification_events",
     endpoint: "notifications/events",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleListEvents,
     summary: "List notification events",
     description:
@@ -263,11 +276,14 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "notificationintentresult_post",
     endpoint: "notification-intent-result",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Report notification delivery result",
     description:
       "Client acknowledgment for local notification delivery outcome.",
     tags: ["notifications"],
-    requirePolicyEnforcement: true,
     handler: handleNotificationIntentResult,
     requestBody: z.object({
       deliveryId: z.string().describe("Notification delivery ID"),

package/src/runtime/routes/oauth-apps.ts

@@ -21,6 +21,7 @@ import {
   upsertApp,
 } from "../../oauth/oauth-store.js";
 import { serializeProviderSummary } from "../../oauth/provider-serializer.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   BadRequestError,
   InternalError,
@@ -305,10 +306,13 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_apps_get",
     endpoint: "oauth/apps",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List OAuth apps",
     description: "List OAuth apps filtered by provider_key.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     queryParams: [
       {
         name: "provider_key",
@@ -323,11 +327,14 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_apps_by_query_get",
     endpoint: "oauth/apps/lookup",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get OAuth app",
     description:
       "Look up a single OAuth app by ID, provider + client_id, or provider (most recent).",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     queryParams: [
       {
         name: "id",
@@ -351,23 +358,27 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_apps_upsert",
     endpoint: "oauth/apps/upsert",
     method: "POST",
-    policyKey: "oauth/apps.upsert",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Upsert OAuth app",
     description:
       "Create or return an existing OAuth app registration. Updates client secret if provided.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleUpsertApp,
   },
   {
     operationId: "oauth_apps_post",
     endpoint: "oauth/apps",
     method: "POST",
-    policyKey: "oauth/apps.create",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create OAuth app",
     description: "Register a new OAuth app with client credentials.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     responseStatus: "201",
     handler: handleCreateApp,
   },
@@ -375,42 +386,53 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_apps_delete",
     endpoint: "oauth/apps/:id",
     method: "DELETE",
-    policyKey: "oauth/apps.delete",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete OAuth app",
     description:
       "Delete an OAuth app and disconnect all its connections.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleDeleteApp,
   },
   {
     operationId: "oauth_apps_connections_get",
     endpoint: "oauth/apps/:appId/connections",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List OAuth connections",
     description: "List connections for an OAuth app.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleListConnections,
   },
   {
     operationId: "oauth_connections_delete",
     endpoint: "oauth/connections/:id",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Disconnect OAuth connection",
     description: "Disconnect a single OAuth connection.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleDeleteConnection,
   },
   {
     operationId: "oauth_apps_connect_post",
     endpoint: "oauth/apps/:appId/connect",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Start OAuth connect",
     description: "Start an OAuth connect flow for an app.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleConnectApp,
   },
 ];

package/src/runtime/routes/oauth-commands-routes.ts

@@ -38,6 +38,7 @@ import { VellumPlatformClient } from "../../platform/client.js";
 import { withValidToken } from "../../security/token-manager.js";
 import { matchHostPattern } from "../../tools/credentials/host-pattern-match.js";
 import { getLogger } from "../../util/logger.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -977,23 +978,28 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_disconnect",
     endpoint: "oauth/disconnect",
     method: "POST",
-    policyKey: "oauth/disconnect",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Disconnect OAuth provider",
     description:
       "Disconnect an OAuth provider and remove associated credentials (BYO or managed).",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleDisconnect,
   },
   {
     operationId: "oauth_mode_get",
     endpoint: "oauth/mode",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Get OAuth mode",
     description:
       "Get the current OAuth mode (managed or your-own) for a provider.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     queryParams: [
       {
         name: "provider",
@@ -1008,22 +1014,27 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_mode_set",
     endpoint: "oauth/mode",
     method: "POST",
-    policyKey: "oauth/mode.set",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Set OAuth mode",
     description: "Set the OAuth mode (managed or your-own) for a provider.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleModeSet,
   },
   {
     operationId: "oauth_status",
     endpoint: "oauth/status",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Get OAuth status",
     description:
       "Show OAuth connection status for a specified provider (BYO or managed).",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     queryParams: [
       {
         name: "provider",
@@ -1038,57 +1049,69 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_ping",
     endpoint: "oauth/ping",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Ping OAuth provider",
     description:
       "Verify an OAuth token is valid by hitting the provider's configured health-check endpoint.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handlePing,
   },
   {
     operationId: "oauth_token",
     endpoint: "oauth/token",
     method: "POST",
-    policyKey: "oauth/token",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Get OAuth token",
     description: "Retrieve a valid OAuth access token for a BYO-mode provider.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleToken,
   },
   {
     operationId: "oauth_request",
     endpoint: "oauth/request",
     method: "POST",
-    policyKey: "oauth/request",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Make authenticated OAuth request",
     description:
       "Make an authenticated HTTP request through an OAuth connection (supports curl-like interface).",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleRequest,
   },
   {
     operationId: "oauth_managed_connect_start",
     endpoint: "oauth/managed-connect/start",
     method: "POST",
-    policyKey: "oauth/managed-connect.start",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Start managed OAuth connect",
     description:
       "Start a managed (platform) OAuth connect flow and return the connect URL.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleManagedConnect,
   },
   {
     operationId: "oauth_managed_connect_poll",
     endpoint: "oauth/managed-connect/poll",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Poll managed OAuth connections",
     description:
       "Fetch active platform connections for a provider (used to detect new connections after managed connect).",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     queryParams: [
       {
         name: "provider",

package/src/runtime/routes/oauth-connect-routes.ts

@@ -21,6 +21,7 @@ import {
   getProvider,
 } from "../../oauth/oauth-store.js";
 import { getLogger } from "../../util/logger.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -185,6 +186,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_oauth_connect_start",
     endpoint: "internal/oauth/connect/start",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Start daemon-owned OAuth connect flow",
     description:
       "Starts an OAuth connect flow in the daemon and returns the authorization URL for the CLI to open in the browser.",
@@ -202,6 +207,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_oauth_connect_status",
     endpoint: "internal/oauth/connect/status/:state",
     method: "GET",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Poll daemon OAuth connect flow status",
     description:
       "Returns the current status of an in-flight daemon-owned OAuth connect flow (pending/complete/error).",

package/src/runtime/routes/oauth-lifecycle-routes.ts

@@ -9,6 +9,7 @@
 import { z } from "zod";
 
 import { getConfig, invalidateConfigCache } from "../../config/loader.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // ── Handlers ──────────────────────────────────────────────────────────
@@ -30,7 +31,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_connection_changed",
     endpoint: "oauth/connection-changed",
     method: "POST",
-    policyKey: "oauth/connection-changed",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleOAuthConnectionChanged,
     summary: "Notify the assistant that an OAuth connection changed",
     description:

package/src/runtime/routes/oauth-providers.ts

@@ -7,6 +7,7 @@
  */
 
 import { loadConfig } from "../../config/loader.js";
+import { getOAuthCallbackUrl } from "../../inbound/public-ingress-urls.js";
 import {
   deleteApp,
   deleteConnection,
@@ -25,6 +26,7 @@ import {
 } from "../../oauth/provider-serializer.js";
 import { isProviderVisible } from "../../oauth/provider-visibility.js";
 import { SEEDED_PROVIDER_KEYS } from "../../oauth/seed-providers.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   BadRequestError,
   ConflictError,
@@ -84,13 +86,24 @@ function handleGetProvider({ pathParams = {} }: RouteHandlerArgs) {
     );
   }
 
-  if (!isProviderVisible(row, loadConfig())) {
+  const config = loadConfig();
+  if (!isProviderVisible(row, config)) {
     throw new NotFoundError(
       `No OAuth provider registered for "${providerKey}"`,
     );
   }
 
-  return { provider: serializeProviderFull(row) };
+  let oauthCallbackUrl: string | null = null;
+  try {
+    oauthCallbackUrl = getOAuthCallbackUrl(config);
+  } catch {
+    // Ingress not configured or disabled — callback URL unavailable
+  }
+
+  return {
+    provider: serializeProviderFull(row),
+    oauth_callback_url: oauthCallbackUrl,
+  };
 }
 
 function handleRegisterProvider({ body = {} }: RouteHandlerArgs) {
@@ -313,11 +326,14 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_providers_get",
     endpoint: "oauth/providers",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List OAuth providers",
     description:
       "List all registered OAuth providers with optional filtering.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleListProviders,
     queryParams: [
       {
@@ -331,21 +347,26 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_providers_by_providerKey_get",
     endpoint: "oauth/providers/:providerKey",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get OAuth provider",
     description: "Get a single OAuth provider by key.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleGetProvider,
   },
   {
     operationId: "oauth_providers_post",
     endpoint: "oauth/providers",
     method: "POST",
-    policyKey: "oauth/providers.register",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Register OAuth provider",
     description: "Register a new OAuth provider configuration.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     responseStatus: "201",
     handler: handleRegisterProvider,
   },
@@ -353,23 +374,27 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_providers_by_providerKey_patch",
     endpoint: "oauth/providers/:providerKey",
     method: "PATCH",
-    policyKey: "oauth/providers.update",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Update OAuth provider",
     description: "Update an existing custom OAuth provider configuration.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleUpdateProvider,
   },
   {
     operationId: "oauth_providers_by_providerKey_delete",
     endpoint: "oauth/providers/:providerKey",
     method: "DELETE",
-    policyKey: "oauth/providers.delete",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete OAuth provider",
     description:
       "Delete a custom OAuth provider and optionally cascade-delete its apps and connections.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleDeleteProvider,
   },
 ];

package/src/runtime/routes/platform-routes.ts

@@ -27,6 +27,7 @@ import {
 } from "../../security/secure-keys.js";
 import { buildAssistantEvent } from "../assistant-event.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import {
   BadRequestError,
   InternalError,
@@ -287,6 +288,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "platform_status",
     endpoint: "platform/status",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Get platform deployment context and connection status",
     description:
       "Aggregates platform context, credentials, assistant ID, webhook secret, and Velay tunnel status.",
@@ -297,6 +302,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "platform_connect",
     endpoint: "platform/connect",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Connect to the Vellum Platform",
     description:
       "Checks existing credentials and emits the show_platform_login signal for connected clients to show a login UI.",
@@ -307,6 +316,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "platform_disconnect",
     endpoint: "platform/disconnect",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Disconnect from the Vellum Platform",
     description:
       "Deletes stored platform credentials and emits platform_disconnected signal to connected clients.",
@@ -317,6 +330,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "platform_callback_routes_register",
     endpoint: "platform/callback-routes/register",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Register a platform callback route",
     description:
       "Registers a callback route with the platform gateway for inbound provider webhooks.",
@@ -327,6 +344,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "platform_callback_routes_list",
     endpoint: "platform/callback-routes",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "List registered platform callback routes",
     description:
       "Lists all callback routes registered with the platform for this assistant.",