Audit, API keys and agents
Agent actions, outbox messages, idempotency keys, and API credentials.
Route: /projects/[projectId]/audit.
API keys
issueApiCredential shows the key once; only a hash is stored. revokeApiCredential revokes it. Scopes: agents:read/write/execute, audit:read, billing:, companies:, contracts:, documents:, execution:, field:, financials:, preconstruction:, projects:, safety: with read or write.
Agent actions
Request
requestAgentAction binds an operation, target, destination status, company, project, agent identity, and scope grant.
Review
reviewAgentAction by a different human: "A different authorized human must approve this action".
Execute
Through the normal transition; the grant is rechecked. recordAgentActionObservation records what happened.
Events
Commands write AgentAction, IdempotencyKey, and OutboxMessage records. npm run outbox:work delivers outbox messages to OUTBOX_WEBHOOK_URL.