Access Model
Who may connect, which packs they hold, and who applies the final signature on writes.
Actors
| Actor | What they do |
|---|---|
| Integrator | Wires Cursor, Claude, or a custom MCP client; holds a Bearer token |
| Operator | Entitles Legate on a Stratum peer; opens install / mint flows; never exports signing material for convenience |
| External signer | Human or dedicated signer that applies the final signature after prepare |
| Legate | Tool plane: verifies tokens, exposes packs, returns prepare/submit interfaces |
Legate is not an LLM host. Sampling, prompts, and generative confirmation UX belong to the MCP client.
Packs and scopes
Access is expressed as capability packs on the token. Callers may only invoke tools in packs their token grants.
| Pack | Boundary |
|---|---|
legate.read | Read / observe tools and authorized resources |
legate.write | Client write sequence: simulate → prepare → submit_signed |
| Ops (by arrangement) | Day-2 capabilities — not a public admin dump |
Scopes ⊆ granted packs. A tool outside the granted set returns 403.
Write authority
| Step | Who acts |
|---|---|
| simulate | Agent / integrator (write pack + consent) |
| prepare | Agent / integrator — returns proposal / review payload; does not commit |
| sign | External signer (human, HSM, or signer agent) — not a long-lived write key inside Legate |
| submit_signed | Agent / integrator submits the signed payload |
Production deployments do not keep long-lived write private keys in the MCP process.
What this page does not publish
- Policy source files or allow/deny rule content
- Scoring / guard engine internals
- Mandate business rules beyond the four-step client sequence
Those stay in private engineering and Agelite materials. See Disclosure Boundary.