@vellumai/assistant 0.8.6 → 0.8.7

package/src/runtime/routes/recording-routes.ts

@@ -28,6 +28,7 @@ import type {
   RecordingStatus,
 } from "../../daemon/message-protocol.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   BadRequestError,
   ConflictError,
@@ -207,8 +208,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "recordings_start",
     endpoint: "recordings/start",
     method: "POST",
-    policyKey: "recordings/start",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Start recording",
     description: "Start a screen recording for a conversation.",
     tags: ["recordings"],
@@ -230,8 +233,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "recordings_stop",
     endpoint: "recordings/stop",
     method: "POST",
-    policyKey: "recordings/stop",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Stop recording",
     description: "Stop the active screen recording.",
     tags: ["recordings"],
@@ -248,8 +253,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "recordings_pause",
     endpoint: "recordings/pause",
     method: "POST",
-    policyKey: "recordings/pause",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Pause recording",
     description: "Pause the active screen recording.",
     tags: ["recordings"],
@@ -266,8 +273,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "recordings_resume",
     endpoint: "recordings/resume",
     method: "POST",
-    policyKey: "recordings/resume",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Resume recording",
     description: "Resume a paused screen recording.",
     tags: ["recordings"],
@@ -284,8 +293,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "recordings_status_get",
     endpoint: "recordings/status",
     method: "GET",
-    policyKey: "recordings/status",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get recording status",
     description: "Return the current recording state.",
     tags: ["recordings"],
@@ -299,8 +310,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "recordings_status_post",
     endpoint: "recordings/status",
     method: "POST",
-    policyKey: "recordings/status:POST",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Post recording status",
     description: "Recording lifecycle callback from the client.",
     tags: ["recordings"],

package/src/runtime/routes/rename-conversation-routes.ts

@@ -13,6 +13,7 @@ import {
   getConversation,
   updateConversationTitle,
 } from "../../memory/conversation-crud.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { publishConversationTitleChanged } from "../sync/resource-sync-events.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
@@ -27,6 +28,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "rename_conversation",
     endpoint: "conversations/rename",
     method: "POST",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Rename a conversation",
     description: "Update the display title of a conversation.",
     tags: ["conversations"],

package/src/runtime/routes/sanity-routes.ts

@@ -16,6 +16,7 @@ import { z } from "zod";
 import { credentialKey } from "../../security/credential-key.js";
 import { getSecureKeyAsync } from "../../security/secure-keys.js";
 import { getWorkspaceDir } from "../../util/platform.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -139,7 +140,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "sanity_discover",
     endpoint: "sanity/discover",
     method: "POST",
-    policyKey: "secrets",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Discover Sanity projects and datasets using the stored API token",
     requestBody: z.object({ projectId: z.string().optional() }).optional(),
     handler: handleDiscover,
@@ -148,7 +152,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "sanity_connect",
     endpoint: "sanity/connect",
     method: "POST",
-    policyKey: "secrets",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Finalise Sanity connection and write sidecar file",
     requestBody: z.object({
       projectId: z.string(),

package/src/runtime/routes/schedule-routes.ts

@@ -12,7 +12,10 @@ import { INTERNAL_GUARDIAN_TRUST_CONTEXT } from "../../daemon/trust-context.js";
 import { bootstrapConversation } from "../../memory/conversation-bootstrap.js";
 import { getConversation } from "../../memory/conversation-crud.js";
 import { normalizeScheduleSyntax } from "../../schedule/recurrence-types.js";
-import { runScript } from "../../schedule/run-script.js";
+import {
+  runScript,
+  validateScriptTimeoutMs,
+} from "../../schedule/run-script.js";
 import {
   cancelSchedule,
   completeScheduleRun,
@@ -27,11 +30,55 @@ import {
   updateSchedule,
 } from "../../schedule/schedule-store.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 const log = getLogger("schedule-routes");
 
+// ---------------------------------------------------------------------------
+// Response schemas (shared by all schedule routes)
+// ---------------------------------------------------------------------------
+
+const scheduleSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  enabled: z.boolean(),
+  syntax: z.enum(["cron", "rrule"]),
+  expression: z.string().nullable(),
+  cronExpression: z.string().nullable(),
+  timezone: z.string().nullable(),
+  message: z.string(),
+  script: z.string().nullable(),
+  nextRunAt: z.number(),
+  lastRunAt: z.number().nullable(),
+  lastStatus: z.string().nullable(),
+  retryCount: z.number(),
+  maxRetries: z.number(),
+  retryBackoffMs: z.number(),
+  timeoutMs: z.number().nullable(),
+  description: z.string().nullable(),
+  mode: z.enum(["notify", "execute", "script", "wake"]),
+  status: z.enum(["active", "firing", "fired", "cancelled"]),
+  routingIntent: z.enum(["single_channel", "multi_channel", "all_channels"]),
+  reuseConversation: z.boolean(),
+  wakeConversationId: z.string().nullable(),
+  isOneShot: z.boolean(),
+});
+
+const scheduleRunSchema = z.object({
+  id: z.string(),
+  jobId: z.string(),
+  status: z.string(),
+  startedAt: z.number(),
+  finishedAt: z.number().nullable(),
+  durationMs: z.number().nullable(),
+  output: z.string().nullable(),
+  error: z.string().nullable(),
+  conversationId: z.string().nullable(),
+  createdAt: z.number(),
+});
+
 // ---------------------------------------------------------------------------
 // Handlers (transport-agnostic)
 // ---------------------------------------------------------------------------
@@ -59,6 +106,7 @@ function handleListSchedules(queryParams: Record<string, string>) {
       retryCount: j.retryCount,
       maxRetries: j.maxRetries,
       retryBackoffMs: j.retryBackoffMs,
+      timeoutMs: j.timeoutMs,
       description:
         j.syntax === "cron"
           ? describeCronExpression(j.cronExpression)
@@ -194,12 +242,21 @@ function handleUpdateSchedule(id: string, body: Record<string, unknown>) {
     "wakeConversationId",
     "maxRetries",
     "retryBackoffMs",
+    "timeoutMs",
   ] as const) {
     if (key in body) {
       updates[key] = body[key];
     }
   }
 
+  if (updates.timeoutMs != null) {
+    if (typeof updates.timeoutMs !== "number") {
+      throw new BadRequestError("timeoutMs must be a number or null");
+    }
+    const timeoutError = validateScriptTimeoutMs(updates.timeoutMs);
+    if (timeoutError) throw new BadRequestError(timeoutError);
+  }
+
   try {
     const updated = updateSchedule(id, updates);
     if (!updated) {
@@ -259,7 +316,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "listSchedules",
     endpoint: "schedules",
     method: "GET",
-    policyKey: "schedules",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List schedules",
     description: "Return all scheduled jobs.",
     tags: ["schedules"],
@@ -272,7 +332,7 @@ export const ROUTES: RouteDefinition[] = [
       },
     ],
     responseBody: z.object({
-      schedules: z.array(z.unknown()).describe("Schedule objects"),
+      schedules: z.array(scheduleSchema).describe("Schedule objects"),
     }),
     handler: ({ queryParams }: RouteHandlerArgs) =>
       handleListSchedules(queryParams ?? {}),
@@ -281,7 +341,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "createSchedule",
     endpoint: "schedules",
     method: "POST",
-    policyKey: "schedules",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create schedule",
     description:
       "Create a new recurring schedule. Currently restricted to mode='execute'.",
@@ -302,7 +365,7 @@ export const ROUTES: RouteDefinition[] = [
       mode: z.string().describe("Currently must be 'execute'").optional(),
     }),
     responseBody: z.object({
-      schedules: z.array(z.unknown()).describe("Updated schedule list"),
+      schedules: z.array(scheduleSchema).describe("Updated schedule list"),
     }),
     handler: ({ body }: RouteHandlerArgs) => handleCreateSchedule(body ?? {}),
   },
@@ -310,7 +373,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "listScheduleRuns",
     endpoint: "schedules/:id/runs",
     method: "GET",
-    policyKey: "schedules",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List schedule runs",
     description: "Return recent invocation history for a schedule.",
     tags: ["schedules"],
@@ -322,7 +388,7 @@ export const ROUTES: RouteDefinition[] = [
       },
     ],
     responseBody: z.object({
-      runs: z.array(z.unknown()).describe("Schedule run objects"),
+      runs: z.array(scheduleRunSchema).describe("Schedule run objects"),
     }),
     handler: ({ pathParams, queryParams }: RouteHandlerArgs) =>
       handleListScheduleRuns(pathParams!.id, queryParams ?? {}),
@@ -331,7 +397,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "toggleSchedule",
     endpoint: "schedules/:id/toggle",
     method: "POST",
-    policyKey: "schedules/toggle",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Toggle schedule",
     description: "Enable or disable a schedule.",
     tags: ["schedules"],
@@ -339,7 +408,7 @@ export const ROUTES: RouteDefinition[] = [
       enabled: z.boolean().describe("New enabled state"),
     }),
     responseBody: z.object({
-      schedules: z.array(z.unknown()).describe("Updated schedule list"),
+      schedules: z.array(scheduleSchema).describe("Updated schedule list"),
     }),
     handler: ({ pathParams, body }: RouteHandlerArgs) =>
       handleToggleSchedule(pathParams!.id, body ?? {}),
@@ -348,12 +417,15 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "deleteSchedule",
     endpoint: "schedules/:id",
     method: "DELETE",
-    policyKey: "schedules",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete schedule",
     description: "Remove a schedule by ID.",
     tags: ["schedules"],
     responseBody: z.object({
-      schedules: z.array(z.unknown()).describe("Updated schedule list"),
+      schedules: z.array(scheduleSchema).describe("Updated schedule list"),
     }),
     handler: ({ pathParams }: RouteHandlerArgs) =>
       handleDeleteSchedule(pathParams!.id),
@@ -362,27 +434,43 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "updateSchedule",
     endpoint: "schedules/:id",
     method: "PATCH",
-    policyKey: "schedules",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Update schedule",
     description: "Partially update fields on a schedule.",
     tags: ["schedules"],
     requestBody: z.object({
-      name: z.string(),
-      expression: z.string(),
-      timezone: z.string(),
-      message: z.string(),
-      script: z.string().nullable().describe("Shell command for script mode"),
-      mode: z.string().describe("notify, execute, or script"),
+      name: z.string().optional(),
+      expression: z.string().optional(),
+      timezone: z.string().optional(),
+      message: z.string().optional(),
+      script: z
+        .string()
+        .nullable()
+        .describe("Shell command for script mode")
+        .optional(),
+      mode: z.string().describe("notify, execute, or script").optional(),
       routingIntent: z
         .string()
-        .describe("single_channel, multi_channel, or all_channels"),
-      quiet: z.boolean(),
-      reuseConversation: z.boolean(),
-      maxRetries: z.number().describe("Maximum retry attempts"),
-      retryBackoffMs: z.number().describe("Retry backoff in milliseconds"),
+        .describe("single_channel, multi_channel, or all_channels")
+        .optional(),
+      quiet: z.boolean().optional(),
+      reuseConversation: z.boolean().optional(),
+      maxRetries: z.number().describe("Maximum retry attempts").optional(),
+      retryBackoffMs: z
+        .number()
+        .describe("Retry backoff in milliseconds")
+        .optional(),
+      timeoutMs: z
+        .number()
+        .nullable()
+        .describe("Script-mode execution timeout in ms; null = use default")
+        .optional(),
     }),
     responseBody: z.object({
-      schedules: z.array(z.unknown()).describe("Updated schedule list"),
+      schedules: z.array(scheduleSchema).describe("Updated schedule list"),
     }),
     handler: ({ pathParams, body }: RouteHandlerArgs) =>
       handleUpdateSchedule(pathParams!.id, body ?? {}),
@@ -391,12 +479,15 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "cancelSchedule",
     endpoint: "schedules/:id/cancel",
     method: "POST",
-    policyKey: "schedules/cancel",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Cancel schedule",
     description: "Cancel a pending schedule.",
     tags: ["schedules"],
     responseBody: z.object({
-      schedules: z.array(z.unknown()).describe("Updated schedule list"),
+      schedules: z.array(scheduleSchema).describe("Updated schedule list"),
     }),
     handler: ({ pathParams }: RouteHandlerArgs) =>
       handleCancelSchedule(pathParams!.id),
@@ -405,12 +496,15 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "runScheduleNow",
     endpoint: "schedules/:id/run",
     method: "POST",
-    policyKey: "schedules/run",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Run schedule now",
     description: "Trigger an immediate execution of a schedule.",
     tags: ["schedules"],
     responseBody: z.object({
-      schedules: z.array(z.unknown()).describe("Updated schedule list"),
+      schedules: z.array(scheduleSchema).describe("Updated schedule list"),
     }),
     handler: ({ pathParams }: RouteHandlerArgs) =>
       handleRunScheduleNow(pathParams!.id),
@@ -434,7 +528,9 @@ async function handleRunScheduleNow(id: string) {
         { jobId: schedule.id, name: schedule.name },
         "Executing script schedule manually (run now)",
       );
-      const result = await runScript(schedule.script);
+      const result = await runScript(schedule.script, {
+        timeoutMs: schedule.timeoutMs ?? undefined,
+      });
       completeScheduleRun(runId, {
         status: result.exitCode === 0 ? "ok" : "error",
         output: result.stdout || undefined,
@@ -469,15 +565,12 @@ async function handleRunScheduleNow(id: string) {
           });
           conversation.taskRunId = taskRunId;
           try {
-            await conversation.processMessage(
-              message,
-              [],
-              () => {},
-              undefined,
-              undefined,
-              undefined,
-              { isInteractive: false },
-            );
+            await conversation.processMessage({
+              content: message,
+              attachments: [],
+              onEvent: () => {},
+              isInteractive: false,
+            });
           } finally {
             conversation.taskRunId = undefined;
           }
@@ -565,15 +658,12 @@ async function handleRunScheduleNow(id: string) {
       trustContext: INTERNAL_GUARDIAN_TRUST_CONTEXT,
     });
     activeConversation.taskRunId = undefined;
-    await activeConversation.processMessage(
-      schedule.message,
-      [],
-      () => {},
-      undefined,
-      undefined,
-      undefined,
-      { isInteractive: false },
-    );
+    await activeConversation.processMessage({
+      content: schedule.message,
+      attachments: [],
+      onEvent: () => {},
+      isInteractive: false,
+    });
     completeScheduleRun(runId, { status: "ok" });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);

package/src/runtime/routes/secret-routes.ts

@@ -45,6 +45,7 @@ import {
   upsertCredentialMetadata,
 } from "../../tools/credentials/metadata-store.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import { getSecretsDeps } from "./secrets-deps.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
@@ -628,7 +629,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "secrets_add",
     endpoint: "secrets",
     method: "POST",
-    policyKey: "secrets",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Add a secret",
     description:
       "Store a new secret (API key, OAuth token, etc.) in the credential vault.",
@@ -649,7 +653,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "secrets_delete",
     endpoint: "secrets",
     method: "DELETE",
-    policyKey: "secrets",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete a secret",
     description: "Remove a secret from the credential vault by name.",
     tags: ["secrets"],
@@ -668,7 +675,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "secrets_list",
     endpoint: "secrets",
     method: "GET",
-    policyKey: "secrets",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List secrets",
     description: "Return the names (not values) of all stored secrets.",
     tags: ["secrets"],
@@ -684,7 +694,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "secrets_read",
     endpoint: "secrets/read",
     method: "POST",
-    policyKey: "secrets",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Read a secret value",
     description: "Retrieve the decrypted value of a stored secret by name.",
     tags: ["secrets"],

package/src/runtime/routes/sequence-routes.ts

@@ -20,6 +20,7 @@ import {
   listSequences,
   updateSequence,
 } from "../../sequence/store.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -205,6 +206,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "sequence_list",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     endpoint: "sequences/list",
     handler: handleSequenceList,
     summary: "List sequences",
@@ -216,6 +221,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "sequence_get",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     endpoint: "sequences/get",
     handler: handleSequenceGet,
     summary: "Get sequence details",
@@ -227,6 +236,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "sequence_pause",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     endpoint: "sequences/pause",
     handler: handleSequencePause,
     summary: "Pause a sequence",
@@ -238,6 +251,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "sequence_resume",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     endpoint: "sequences/resume",
     handler: handleSequenceResume,
     summary: "Resume a paused sequence",
@@ -249,6 +266,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "sequence_cancel_enrollment",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     endpoint: "sequences/cancel-enrollment",
     handler: handleCancelEnrollment,
     summary: "Cancel a specific enrollment",
@@ -260,6 +281,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "sequence_stats",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     endpoint: "sequences/stats",
     handler: handleSequenceStats,
     summary: "Overall sequence stats",
@@ -270,6 +295,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "sequence_guardrails_show",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     endpoint: "sequences/guardrails",
     handler: handleGuardrailsShow,
     summary: "Show guardrail configuration",
@@ -280,6 +309,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "sequence_guardrails_set",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     endpoint: "sequences/guardrails",
     handler: handleGuardrailsSet,
     summary: "Update a guardrail setting",