Reviewed source-contract reference. CLI 0.13.4 is released. Hosted pack contracts below are taken from Agent source 573c9a11b1b6674b163ce21273a162a4ed453282; their activation and deployed worked responses remain pending. This draft does not establish settings, shared context or intake acceptance for the existing 70 Codex and 70 Claude agents.
Separate four boundaries
An organization policy is an execution ceiling. Machine-local consent, native enforcement/readback, and platform action authorization remain separate. The request to grant Ash's existing pack full access does not make unrestricted access a customer default or authorize unrelated business operations.
Read organization_execution_policy.get in the intended authenticated organization. Validate the contract version, context, revision and canonical policy digest. Version 1.0 uses allowlists. Version 1.1 adds explicit scopePolicyMode. Missing/unavailable/malformed policy refuses activation; absent rows have restrictive defaults.
Interpret policy 1.1
allowlist with empty tool/action lists denies those capabilities. The native adapter refuses allowlist activation until exact filtering can be enforced. unrestricted is explicit, requires empty tool/action lists and still preserves profile ceilings, consent, intake restrictions and server authorization. Profiles are manual, role-default, and full-access; per-role consent can reduce the chosen profile. Claude Manual is not read-only filesystem confinement.
Use an active, remotely verified human identity in the organization whose policy will change. The verified principal must have role owner or admin in that same organization and an explicit app_topolo_agent.organization_execution_policy:write or agent.organization_execution_policy:write grant. Auth must resolve an active Agent workspace in the same organization and app with admin access; an omitted workspace header causes default-workspace resolution, not a waiver. A supplied header is only a claim until Auth verifies it. Platform roles, wildcard scopes, agents:write, service credentials and resource-bound API keys do not supply this authority. Discover the credential-scoped published contract, plan the complete policy using the current expected revision and genuine decision reference, and confirm the unchanged authorized mutation. Verified minimumAccess and workspace accessLevel must both be admin. A workspace_admin_context_required refusal requires selecting an already authorized active Agent workspace and verifying its admin access; it does not authorize a role upgrade or permission bypass. A platform role, wildcard or agents:write alone does not supply this capability; a resource-bound API key is not workspace-admin authority. Plan the complete policy with the current expected revision and genuine decision reference. A conflict writes nothing. After an uncertain response, GET and compare revision/digest before deciding any new write.
Route decisions through the owning intake
Every role routes to an intake inside the same owned roster and organization. Native permission notifications are requests, not human consent. Record a human decision for the exact intake/request fingerprint before relaying a one-request response. A delivery or response uncertainty remains durable; it is not silently replayed. Unsupported/card-only permissions remain in the original native interaction.
topolo agent-packs approvals list
topolo agent-packs approvals details <request-key> --intake <owning-thread-id> --fingerprint <pending-fingerprint>
These are inspection templates. Applying policy or sending an approval response requires its separately reviewed request and authority. A persisted policy, relay delivery, decision ACK and resulting action outcome each needs its own receipt. Current all-140 runtime acceptance remains pending.