Capabilities

A capability is written resource:action:scope.

github.pr:merge:repo/orvay
email.outbound:send:acme.com
voice.call:answer:+15550100

Forbidden is a different answer, not a stronger warning

A capability can be granted as autonomous, requiring approval, restricted, or forbidden. Forbidden is absolute: no role, no approval, no plan tier and no emergency turns it into an allow. There is no override path, because an override path is what a forbidden capability would be tested with.

Direction lives in the resource

voice.call:answer and voice.call:place are different capabilities, and place does not exist in the registry at all. Answering a call somebody made to you and placing a call to somebody who did not ask are not the same act, and encoding that in the grammar means no configuration can conflate them.

Untrusted context cannot raise a tier

Context fed to a model carries a trust label. Untrusted context can never raise a capability tier, and any contract citing untrusted context is risk-bumped and loses eligibility for automatic approval.