The vault's tool surface for agents

Any MCP-compatible client — an agent, a custom front-end — reaches the

vault through the published tools, and through nothing else. The surface

covers what a compartment-holding PERSON can do to documents: searching,

reading, thinking, uploading, editing, listing and comparing versions,

the documents the vault could not read, the caller's own held uploads,

the review workflow inside their compartments, and their own figures. It

stops there — the administrator's console, anybody's account and the

audit trail are not tools. The tool surface holds no power of its own:

every call travels the same verified, compartment-bounded, audited data

access layer as a human query. Each tool publishes its parameter schema

and its error vocabulary, arguments are checked against that schema

before any data is touched, and a refused call explains itself in

contract terms — never in details that would leak what the caller may

not see.

The vault publishes exactly its tools with their contracts

Given the vault's tool surface
When a client asks for the tool listing
Then exactly the document tools are published, each with a schema and its error codes
And no tool for the administrator's console, an account, or the audit trail is published

Arguments outside the published schema are refused before any data access

Given the vault's tool surface
When a client calls search with arguments violating the published schema
Then the call is refused as invalid parameters without touching the vault

A denial about what the caller may not see carries no reason

Given a tool surface whose vault denies its caller
When the client calls the read tool
Then the tool answers a bare denial with no reason attached

A caller whose kind holds no compartment is told so, not handed an empty result

Given a tool surface whose caller is an administrator
When the client calls the search tool
Then the tool names the caller's own kind and refuses
And the refusal is recorded in the audit trail

A commit whose base is no longer current is refused

Given a document that changed after the client's checkout
When the client commits against its stale base
Then the commit is refused as stale and no version lands

An agent files, finds, and revises a document through the toolsstack

Given a signed-in vault member with their own compartment
When the agent ingests a report through the tool surface
And the agent searches for it and reads the found version in full
And the agent checks the document out and commits a revision
Then search returns the revision and the superseded original on request

Tool calls beyond the caller's compartments are denied and auditedstack

Given a signed-in vault member with their own compartment
And a document filed beyond that member's reach
When the member tries to read, check out, and revise it through the tools
Then every attempt is a bare denial leaving an audit trail