Tool profiles and action reading

Intertrace reads what a call does from its name and arguments; tool profiles and protected branches only raise the result.

Reading what a call does

Intertrace reads a call from its name and its arguments: git force pushes, deletes and protected branches; SQL statements including comments, batches and grants; shell commands including substitutions, piping a download into a shell and sudo; cloud, messages, payments, HTTP and credential paths. This only raises a call's tier. A push to a protected branch is production.

Tool profiles

A tool profile sets the tier of a tool, from a person, an MCP annotation or a one-time AI reading. Profiles only raise. Manage them in Policies, Access, Tools. Only your organization's own profiles (person or AI) raise the ceiling that pre-approvals cover; MCP annotations raise only the call's tier.

GET  /api/org/tool-profiles
POST /api/org/tool-profiles

Protected branches

GET /api/org/protected-branches
PUT /api/org/protected-branches

30-day replay

See what a profile change would have decided differently over the last 30 days:

GET /api/org/tool-profiles/replay