Why open database access is the wrong design
Giving a model direct query or write access to a production database looks flexible and is unmanageable. Every prompt becomes a potential schema change, permissions collapse into whatever the connection user can do, and nothing is reviewable afterwards.
A registry inverts that. The surface area is enumerable, reviewable and testable, and it changes only when an engineer ships a change.
What a single registered action declares
- A stable identifier such as leads.create or appointments.book.
- A typed input schema, validated before any work happens.
- The role or capability required to invoke it.
- Its side effects: internal write, external send, financial, destructive.
- Whether it requires a confirmation step before it executes.
The gap between the catalog and reality
A capability manifest lists what a system advertises. That list is genuinely useful — it lets other software discover what exists — but it proves nothing on its own.
An entry is only a current capability once there is a handler behind it, a permission mapping for it, and a real execution that produced a persisted record. Anything short of that is a declared capability and should be described that way.
Failing closed
- An unrecognized action identifier is rejected, not approximated.
- A missing required argument stops the call rather than guessing a value.
- A permission check failure returns a refusal that is logged.
- An entitlement limit blocks execution and explains why.