Toolbox

The catalog is a closed list. An assistant platform where tools register themselves at runtime can tell you what its assistants happened to do, never what they are able to do. The “Runs” column is the one that was missing until Phase 6: a permission is only meaningful if something exists behind it. The ceilings are Phase 7’s, and they are enforced beside the scope check rather than in the assistant loop — a limit the loop applies is a limit a scheduled job does not have.

Medical will not read patient data until it can encrypt it — for an assistant exactly as for a person. The Medical tools above decline for that reason, which is the behaviour an auditor would ask for.

A disabled team assistant can call nothing, whatever it was granted. A gated team assistant stops at its first data-changing call and leaves it pending — the action is described and not performed, rather than performed and reported afterwards.

- knowledge.search: Retrieve passages from the organisation’s indexed documents. Arguments: query: string — what to search the documents for
- crm.read: Look up leads, contacts, companies and opportunities. Arguments: entity: enum (contacts|companies|leads) — which records to read; limit?: number — how many rows
- crm.write: Create or update a CRM record. Arguments: action: enum (create_contact|log_activity) — what to write; firstName?: string — contact first name; lastName?: string — contact last name; email?: string — contact email; contactId?: string — contact the activity concerns; subject?: string — activity subject; body?: string — activity detail CHANGES DATA.
- tasks.write: Add a task for a human to pick up. Arguments: title: string — what needs doing; description?: string — detail; dueInDays?: number — days until due CHANGES DATA.
- reports.read: Read generated reports and their underlying aggregates. No arguments.
- systems.read: Read system health, checks and incidents. Arguments: entity?: enum (systems|incidents) — systems or incidents
- alerts.write: Raise an alert or notification to a human. Arguments: subject: string — what is wrong; severity?: enum (INFO|WARNING|CRITICAL) — how bad; detail?: string — supporting detail CHANGES DATA.
- revenue.opportunities.read: Read open opportunities ranked by the documented priority model, with the evidence for each score. Arguments: view?: enum (priority|dormant|health) — priority for the ranked worklist, dormant for stale deals only, health for pipeline totals; minDaysDormant?: number — only deals untouched for at least this many days (dormant starts at 21); minAmount?: number — only deals worth at least this many dollars; limit?: number — how many rows
- revenue.quality.read: Aggregate counts of what the customer's data can and cannot support. No personal records. No arguments.
- revenue.attribution.read: What followed a campaign — contacted, influenced, converted. Never a revenue claim. Arguments: campaignId: string — the campaign to report on
- revenue.campaigns.read: Read reactivation campaigns, their targets and their outcomes. Arguments: campaignId?: string — one campaign to look at in detail; omit for a list of all of them
- revenue.campaigns.write: Propose a reactivation campaign over dormant opportunities. Creates a PROPOSAL only — no work exists until a person approves it. Arguments: name: string — a short name for this campaign, for the person who will review it; minDaysDormant?: number — how stale a deal must be to be included; minAmount?: number — minimum deal value in dollars; limit?: number — how many accounts to include, at most; callableOnly?: enum (yes|no) — yes to include only accounts with a phone number, which is what a calling campaign needs CHANGES DATA.
- dial.queues.read: Read call queues and how much work is waiting in them. No arguments.
- medical.cohort: Read counts across the patient panel — recall states, reactivation windows, responsiveness. Counts only; no patient is identified. Arguments: view: enum (lapse|reactivation|panel|responsiveness) — which population summary to read: lapse (recall states), reactivation (how long since last visit), panel (overall practice figures), or responsiveness (how fast inbound requests are answered)
- medical.recall: Start recall outreach across a cohort. Each patient is resolved and gated server-side; the agent names a population, never a person. Arguments: campaign: string — a name for this recall campaign, for the outreach record; purpose: enum (treatment|payment|operations|marketing|fundraising|research) — the HIPAA purpose. Recall for care due is treatment; anything promotional is marketing and needs written authorization on file; channel: enum (call|sms|email|mail|portal) — how to reach them; state?: enum (due|overdue|lapsed) — which recall state to act on. Defaults to overdue.; limit?: number — how many patients at most (ceiling 25) CHANGES DATA.

Generated from the executors, so it cannot drift from what the runtime accepts. A model is shown only the tools the team assistant actually holds; a call to anything else is refused by name and fed back, so the assistant can try something it is allowed to do rather than failing the whole run.

A provider is configured, so these 15 tools are also sent as JSON Schema through the provider's own tool-calling protocol. Until Phase 7 the model was asked to “reply with JSON only” and the reply was parsed. That fails silently: a model that wraps its JSON in a sentence produces a parse error indistinguishable from an assistant with nothing to do. A structured tool call is a better request — it is not permission, and everything below still applies to it.