@vellumai/assistant 0.8.6 → 0.8.7

package/src/runtime/routes/brain-graph-routes.ts

@@ -14,6 +14,7 @@ import { z } from "zod";
 import { getDb } from "../../memory/db-connection.js";
 import { memoryGraphNodes } from "../../memory/schema.js";
 import { resolveBundledDir } from "../../util/bundled-asset.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { RouteError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -105,6 +106,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "brain_graph_get",
     endpoint: "brain-graph",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get brain graph data",
     description:
       "Return a knowledge-graph shaped for brain-lobe visualization, with memory items mapped to brain regions.",
@@ -124,6 +129,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "brain_graph_ui",
     endpoint: "brain-graph-ui",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Serve brain graph UI",
     description:
       "Return the brain-graph HTML visualization page. The gateway injects an auth token before serving.",

package/src/runtime/routes/browser-routes.ts

@@ -18,6 +18,7 @@ import {
 } from "../../browser/types.js";
 import { findConversation } from "../../daemon/conversation-store.js";
 import type { ContentBlock } from "../../providers/types.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // ── Param validation ─────────────────────────────────────────────────
@@ -105,6 +106,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "browser_execute",
     endpoint: "browser/execute",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleBrowserExecute,
     summary: "Execute a browser operation",
     description:

package/src/runtime/routes/browser-tabs-routes.ts

@@ -15,6 +15,7 @@ import {
   setPinnedTab,
 } from "../../tools/browser/pinned-tabs.js";
 import type { ToolContext } from "../../tools/types.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import { browserCliConversationKey } from "./browser-routes.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
@@ -171,6 +172,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "browser_tabs",
     endpoint: "browser/tabs",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleBrowserTabs,
     summary: "Manage browser tabs",
     description:

package/src/runtime/routes/btw-routes.ts

@@ -24,6 +24,7 @@ import { getConversationByKey } from "../../memory/conversation-key-store.js";
 import { getAllToolDefinitions } from "../../tools/registry.js";
 import { getLogger } from "../../util/logger.js";
 import { getWorkspacePromptPath } from "../../util/platform.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { runBtwSidechain } from "../btw-sidechain.js";
 import { BadRequestError, ServiceUnavailableError } from "./errors.js";
 import { getCachedIntro, setCachedIntro } from "./identity-intro-cache.js";
@@ -179,7 +180,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "runBtwSidechain",
     endpoint: "btw",
     method: "POST",
-    policyKey: "btw",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Run ephemeral LLM side-chain",
     description:
       "Stream an ephemeral LLM call reusing the conversation's provider and message history. Response is SSE (btw_text_delta, btw_complete, btw_error).",

package/src/runtime/routes/cache-routes.ts

@@ -12,6 +12,7 @@ import {
   getCacheEntry,
   setCacheEntry,
 } from "../../skills/skill-cache-store.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // ── Handlers ──────────────────────────────────────────────────────────
@@ -55,6 +56,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "cache_set",
     endpoint: "cache/set",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleCacheSet,
     summary: "Set a cache entry",
     description:
@@ -69,6 +74,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "cache_get",
     endpoint: "cache/get",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleCacheGet,
     summary: "Get a cache entry",
     description: "Retrieve a cached value by key. Returns null if not found.",
@@ -84,6 +93,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "cache_delete",
     endpoint: "cache/delete",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleCacheDelete,
     summary: "Delete a cache entry",
     description: "Remove a cached value by key.",

package/src/runtime/routes/call-routes.ts

@@ -20,6 +20,7 @@ import {
 import { getConfig } from "../../config/loader.js";
 import { VALID_CALLER_IDENTITY_MODES } from "../../config/schema.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, ForbiddenError, RouteError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -238,8 +239,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "calls_start",
     endpoint: "calls/start",
     method: "POST",
-    policyKey: "calls/start",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["calls.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Start a call",
     description:
       "Initiate a new outbound phone call. Supports idempotency keys to prevent duplicate calls.",
@@ -276,8 +279,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "calls_cancel",
     endpoint: "calls/:callSessionId/cancel",
     method: "POST",
-    policyKey: "calls/cancel",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["calls.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Cancel a call",
     description: "Cancel an active or pending call.",
     tags: ["calls"],
@@ -294,8 +299,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "calls_answer",
     endpoint: "calls/:callSessionId/answer",
     method: "POST",
-    policyKey: "calls/answer",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["calls.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Answer a pending call question",
     description:
       "Provide an answer to a pending question during an active call.",
@@ -317,8 +324,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "calls_instruction",
     endpoint: "calls/:callSessionId/instruction",
     method: "POST",
-    policyKey: "calls/instruction",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["calls.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Relay instruction to active call",
     description: "Send a real-time instruction to an active call.",
     tags: ["calls"],
@@ -334,8 +343,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "calls_get",
     endpoint: "calls/:callSessionId",
     method: "GET",
-    policyKey: "calls",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["calls.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get call status",
     description: "Return the current status and details of a call session.",
     tags: ["calls"],

package/src/runtime/routes/channel-availability-routes.ts

@@ -26,6 +26,7 @@ import {
 } from "../../channels/types.js";
 import { getConfig } from "../../config/loader.js";
 import { VellumPlatformClient } from "../../platform/client.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // Base list every assistant currently surfaces. Order is the display
@@ -108,6 +109,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channels_available_get",
     endpoint: "channels/available",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get available channels",
     description:
       "Return the channels this assistant can surface to clients, with " +
@@ -115,7 +120,6 @@ export const ROUTES: RouteDefinition[] = [
       "copy). Today this is a fixed base list plus `email` when an inbox " +
       "is registered; will become plugin/skill-driven in future.",
     tags: ["channels"],
-    requirePolicyEnforcement: true,
     handler: handleGetChannelAvailability,
     responseBody: z.object({
       channels: z

package/src/runtime/routes/channel-readiness-routes.ts

@@ -9,6 +9,7 @@ import { z } from "zod";
 
 import type { ChannelId } from "../../channels/types.js";
 import { getReadinessService } from "../../daemon/handlers/config-channels.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   getInviteAdapterRegistry,
   resolveAdapterHandle,
@@ -80,6 +81,28 @@ async function handleRefreshChannelReadiness({ body = {} }: RouteHandlerArgs) {
   return { success: true, snapshots: enriched };
 }
 
+// ---------------------------------------------------------------------------
+// Response schemas (drive OpenAPI spec → codegen → typed SDK)
+// ---------------------------------------------------------------------------
+
+const readinessCheckSchema = z.object({
+  name: z.string(),
+  passed: z.boolean(),
+  message: z.string().nullable().optional(),
+});
+
+const readinessSnapshotSchema = z.object({
+  channel: z.string(),
+  ready: z.boolean(),
+  setupStatus: z.string().nullable().optional(),
+  checkedAt: z.number().nullable().optional(),
+  stale: z.boolean().optional(),
+  reasons: z.array(z.string()).optional(),
+  localChecks: z.array(readinessCheckSchema).optional(),
+  remoteChecks: z.array(readinessCheckSchema).optional(),
+  channelHandle: z.string().nullable().optional(),
+});
+
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
@@ -89,10 +112,13 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channels_readiness_get",
     endpoint: "channels/readiness",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get channel readiness",
     description: "Return readiness snapshots for one or all channels.",
     tags: ["channels"],
-    requirePolicyEnforcement: true,
     handler: handleGetChannelReadiness,
     queryParams: [
       {
@@ -108,17 +134,22 @@ export const ROUTES: RouteDefinition[] = [
     ],
     responseBody: z.object({
       success: z.boolean(),
-      snapshots: z.array(z.unknown()).describe("Channel readiness snapshots"),
+      snapshots: z
+        .array(readinessSnapshotSchema)
+        .describe("Channel readiness snapshots"),
     }),
   },
   {
     operationId: "channels_readiness_refresh_post",
     endpoint: "channels/readiness/refresh",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Refresh channel readiness",
     description: "Invalidate cache and re-evaluate channel readiness.",
     tags: ["channels"],
-    requirePolicyEnforcement: true,
     handler: handleRefreshChannelReadiness,
     requestBody: z.object({
       channel: z.string().describe("Optional channel ID to refresh"),
@@ -128,7 +159,9 @@ export const ROUTES: RouteDefinition[] = [
     }),
     responseBody: z.object({
       success: z.boolean(),
-      snapshots: z.array(z.unknown()).describe("Refreshed readiness snapshots"),
+      snapshots: z
+        .array(readinessSnapshotSchema)
+        .describe("Refreshed readiness snapshots"),
     }),
   },
 ];

package/src/runtime/routes/channel-route-definitions.ts

@@ -1,6 +1,7 @@
 /**
  * Static ROUTES array for channel endpoints.
  */
+import { ACTOR_PRINCIPALS, GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import {
   handleChannelDeliveryAck,
   handleListDeadLetters,
@@ -17,6 +18,10 @@ export const CHANNEL_ROUTES: RouteDefinition[] = [
     operationId: "channel_delete_conversation",
     endpoint: "channels/conversation",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete channel conversation",
     description: "Delete a conversation by channel source.",
     tags: ["channels"],
@@ -26,6 +31,10 @@ export const CHANNEL_ROUTES: RouteDefinition[] = [
     operationId: "channel_inbound",
     endpoint: "channels/inbound",
     method: "POST",
+    policy: {
+      requiredScopes: ["ingress.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Process inbound channel message",
     description: "Receive an inbound message from a channel integration.",
     tags: ["channels"],
@@ -35,6 +44,10 @@ export const CHANNEL_ROUTES: RouteDefinition[] = [
     operationId: "channel_delivery_ack",
     endpoint: "channels/delivery-ack",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Acknowledge channel delivery",
     description: "Acknowledge delivery of a channel message.",
     tags: ["channels"],
@@ -45,6 +58,10 @@ export const CHANNEL_ROUTES: RouteDefinition[] = [
     operationId: "channel_dead_letters",
     endpoint: "channels/dead-letters",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List dead letters",
     description: "Return undeliverable channel messages.",
     tags: ["channels"],
@@ -54,6 +71,10 @@ export const CHANNEL_ROUTES: RouteDefinition[] = [
     operationId: "channel_replay_dead_letters",
     endpoint: "channels/replay",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Replay dead letters",
     description: "Retry delivery of dead-letter messages.",
     tags: ["channels"],

package/src/runtime/routes/channel-verification-routes.ts

@@ -19,6 +19,7 @@ import {
 } from "../../daemon/handlers/config-channels.js";
 import { normalizePhoneNumber } from "../../util/phone.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { revokePendingSessions } from "../channel-verification-service.js";
 import {
   cancelOutbound,
@@ -271,6 +272,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channel_verification_sessions_create",
     endpoint: "channel-verification-sessions",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create verification session",
     description:
       "Create a channel verification session (inbound challenge, outbound, or trusted contact).",
@@ -290,6 +295,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channel_verification_sessions_resend",
     endpoint: "channel-verification-sessions/resend",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Resend verification code",
     description: "Resend the outbound verification code.",
     tags: ["channel-verification"],
@@ -303,6 +312,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channel_verification_sessions_cancel",
     endpoint: "channel-verification-sessions",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Cancel verification sessions",
     description:
       "Cancel all active inbound and outbound verification sessions.",
@@ -316,6 +329,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channel_verification_sessions_revoke",
     endpoint: "channel-verification-sessions/revoke",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Revoke verification binding",
     description: "Cancel all sessions and revoke the guardian binding.",
     tags: ["channel-verification"],
@@ -328,6 +345,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channel_verification_sessions_status",
     endpoint: "channel-verification-sessions/status",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get verification status",
     description: "Check guardian binding and verification session status.",
     tags: ["channel-verification"],

package/src/runtime/routes/chatgpt-subscription-auth-routes.ts

@@ -28,6 +28,7 @@ import {
 } from "../../security/oauth2.js";
 import { setSecureKeyAsync } from "../../security/secure-keys.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -214,7 +215,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_chatgpt_subscription_auth",
     endpoint: "inference/chatgpt-subscription/auth",
     method: "POST",
-    policyKey: "inference/provider-connections",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Start ChatGPT subscription OAuth PKCE flow",
     description:
       "Generate a PKCE authorize URL for ChatGPT subscription auth. Returns the URL and state for the client to open in a browser.",
@@ -229,7 +233,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_chatgpt_subscription_auth_exchange",
     endpoint: "inference/chatgpt-subscription/auth/exchange",
     method: "POST",
-    policyKey: "inference/provider-connections",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Exchange ChatGPT subscription OAuth authorization code",
     description:
       "Accept an authorization code and state from the OAuth redirect, exchange it for tokens, store them in CES, and upsert the provider connection.",

package/src/runtime/routes/client-routes.ts

@@ -11,6 +11,7 @@ import type { HostProxyCapability } from "../../channels/types.js";
 import { isHttpAuthDisabled } from "../../config/env.js";
 import { datesToISO } from "../../util/json.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -19,6 +20,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "list_clients",
     endpoint: "clients",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List connected clients",
     description:
       "Return all connected clients, optionally filtered by capability.",
@@ -78,6 +83,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "disconnect_client",
     endpoint: "clients/disconnect",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Force-disconnect a client",
     description:
       "Dispose all hub subscribers for the given clientId, forcibly closing their SSE streams.",

package/src/runtime/routes/consolidation-routes.ts

@@ -27,6 +27,7 @@ import {
 } from "../../memory/jobs-store.js";
 import { GRAPH_MAINTENANCE_CHECKPOINTS } from "../../memory/jobs-worker.js";
 import { MEMORY_V2_CONSOLIDATION_SOURCE } from "../../memory/v2/constants.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -56,8 +57,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "getConsolidationConfig",
     endpoint: "consolidation/config",
     method: "GET",
-    policyKey: "consolidation",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get consolidation config",
     description:
       "Return the current memory v2 consolidation schedule configuration.",
@@ -89,8 +92,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "runConsolidationNow",
     endpoint: "consolidation/run-now",
     method: "POST",
-    policyKey: "consolidation",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Run consolidation now",
     description:
       "Enqueue an immediate memory v2 consolidation job. Returns once the job is queued; the job itself runs through the memory jobs worker.",
@@ -120,7 +125,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "listConsolidationRuns",
     endpoint: "consolidation/runs",
     method: "GET",
-    policyKey: "consolidation",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List consolidation runs",
     description:
       "Return recent memory v2 consolidation conversations as run records. " +

package/src/runtime/routes/contact-prompt-routes.ts

@@ -20,6 +20,7 @@ import { z } from "zod";
 
 import { getLogger } from "../../util/logger.js";
 import { broadcastMessage } from "../assistant-event-hub.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 const log = getLogger("contact-prompt-routes");
@@ -155,6 +156,10 @@ export const CONTACT_PROMPT_ROUTES: RouteDefinition[] = [
     operationId: "contacts_prompt",
     endpoint: "contacts/prompt",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleContactPrompt,
     summary: "Prompt user to register a contact channel",
     description:
@@ -174,6 +179,10 @@ export const CONTACT_PROMPT_ROUTES: RouteDefinition[] = [
     operationId: "resolve_contact_prompt",
     endpoint: "resolve_contact_prompt",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: resolveContactPrompt,
     summary: "Gateway callback: resolve a pending contact prompt",
     description: