Capabilities
Named actions, checked and recorded.
Every action in CORE is a capability: a name, a typed input, a permission check and an event. There are no routes that bypass it and no dashboards that own it.
Definition
What a capability is
A capability is a named action with a typed input. Invoking it runs four steps in order: resolve the identity, check the permission, execute the handler in a transaction and emit the event. If any step fails, nothing is written.
Reads are capabilities too. page.get and catalog.list go through the same identity check as site.publish; they simply emit no event, because nothing changed.
- Name
site.content.update- Layer
- 05Knowledge
- Access
- Member of the organization
- Emits
- site.content.updated
- Does
- Propose a content change as a new revision; publishing is a separate step.
Naming
domain.entity.verb
Names are lower-case words joined by dots, two to four segments long: the domain, optionally the entity, then the verb. site.publish, catalog.product.update and permission.grant all follow the rule.
The name is the contract. An interface asks for site.content.update and does not care whether the handler lives in this process or on a hosted CORE.
^[a-z]+(?:\.[a-z]+){1,3}$| Name | Domain | Entity | Verb |
|---|---|---|---|
site.publish | site | none | publish |
catalog.product.update | catalog | product | update |
permission.grant | permission | none | grant |
Origins
Same action, five origins
site.content.update can arrive from an editor’s form, an API call, an agent’s decision, a scheduled automation or a chat message. The check is identical: the same identity resolution, the same permission formula, the same event.
The origin is recorded on the event, so the audit log can answer which changes agents made this week without a separate system.
- Interface: a form or button in a website or application.
- API: a request from another system, authenticated with a token.
- Agent: an action proposed or executed by an agent with its own identity.
- Automation: a scheduled job or an event trigger.
- 2finity.chat: a message resolved to an intent and then to a capability.
The same authorized action can originate from Interface, API, Agent, Automation or 2finity.chat.
- Identity: identity.current()
- Permission: permissions.can()
- Capability: site.content.update
- Event: site.content.updated
Catalogue
Capabilities by layer
Each layer exposes its own capabilities, and every featured capability on this site appears in exactly one layer. The catalogue is generated from the layer model, so it cannot drift from the pages that describe each layer.
01 Identity
Open layerWho or what is acting?
| Capability | Description | Access | Emits |
|---|---|---|---|
identity.current | Return the acting identity for the current session or token. | Public | none (read) |
identity.verify | not listed | not listed | not listed |
identity.link | not listed | not listed | not listed |
session.create | not listed | not listed | not listed |
session.revoke | not listed | not listed | not listed |
permission.grant | Grant an identity a role or capability on a resource inside an organization. | Privileged role or approval | permission.granted |
permission.revoke | not listed | not listed | not listed |
permission.check | Answer whether an actor may invoke a capability on a resource. | Member of the organization | none (read) |
02 Organizations
Open layerInside which boundary?
| Capability | Description | Access | Emits |
|---|---|---|---|
organization.get | Read an organization and its boundary settings. | Member of the organization | none (read) |
organization.create | not listed | not listed | not listed |
organization.update | not listed | not listed | not listed |
team.create | not listed | not listed | not listed |
team.member.add | not listed | not listed | not listed |
department.create | not listed | not listed | not listed |
membership.invite | Invite a person into an organization with a role. | Privileged role or approval | membership.invited |
membership.revoke | not listed | not listed | not listed |
03 People
Open layerWho do we work with?
| Capability | Description | Access | Emits |
|---|---|---|---|
person.get | not listed | not listed | not listed |
person.create | not listed | not listed | not listed |
person.update | not listed | not listed | not listed |
person.merge | not listed | not listed | not listed |
customer.get | Read a customer record with its relationships to the organization. | Member of the organization | none (read) |
lead.create | not listed | not listed | not listed |
lead.qualify | not listed | not listed | not listed |
lead.list | List leads, filterable by source, region and period. | Member of the organization | none (read) |
04 Relationships
Open layerHow are they connected?
| Capability | Description | Access | Emits |
|---|---|---|---|
relationship.create | Connect two parties with a typed relationship and validity period. | Privileged role or approval | relationship.created |
relationship.get | not listed | not listed | not listed |
relationship.list | not listed | not listed | not listed |
relationship.end | not listed | not listed | not listed |
role.grant | not listed | not listed | not listed |
role.revoke | not listed | not listed | not listed |
partner.link | not listed | not listed | not listed |
agent.owner.set | Assign the human or organization accountable for an agent. | Privileged role or approval | agent.owner.changed |
05 Knowledge
Open layerWhat do we know and publish?
| Capability | Description | Access | Emits |
|---|---|---|---|
site.content.update | Propose a content change as a new revision; publishing is a separate step. | Member of the organization | site.content.updated |
site.publish | Publish pending revisions of a site or page. | Privileged role or approval | site.published |
page.get | Read a published page by route or id. | Public | none (read) |
page.create | Create a page from a brief or template as a draft revision. | Member of the organization | page.created |
document.create | not listed | not listed | not listed |
document.get | not listed | not listed | not listed |
policy.get | not listed | not listed | not listed |
knowledge.search | not listed | not listed | not listed |
06 Workflows
Open layerHow does work move?
| Capability | Description | Access | Emits |
|---|---|---|---|
workflow.start | Start a workflow instance for an entity. | Member of the organization | workflow.started |
workflow.get | not listed | not listed | not listed |
task.create | not listed | not listed | not listed |
task.complete | not listed | not listed | not listed |
approval.request | not listed | not listed | not listed |
approval.decide | Approve or reject a pending step. | Privileged role or approval | approval.decided |
deployment.publish | Promote a revision set to live. | Privileged role or approval | deployment.published |
deployment.rollback | Return a site or application to a previous revision. | Privileged role or approval | deployment.rolled_back |
07 Commerce
Open layerWhat do we sell?
| Capability | Description | Access | Emits |
|---|---|---|---|
catalog.list | List published products and services, optionally by category. | Public | none (read) |
catalog.product.get | Read one product with variants and prices. | Public | none (read) |
catalog.product.update | Change product data as a draft. | Member of the organization | catalog.product.updated |
catalog.product.publish | Make a product visible in the catalog. | Privileged role or approval | catalog.product.published |
quote.create | not listed | not listed | not listed |
cart.add | not listed | not listed | not listed |
order.create | not listed | not listed | not listed |
order.update | Change an order's state, lines or delivery. | Member of the organization | order.updated |
08 Finance
Open layerWhat is owed and paid?
| Capability | Description | Access | Emits |
|---|---|---|---|
invoice.create | Create an invoice from an order or by hand. | Member of the organization | invoice.created |
invoice.get | not listed | not listed | not listed |
invoice.send | not listed | not listed | not listed |
invoice.void | not listed | not listed | not listed |
payment.record | not listed | not listed | not listed |
payment.list | not listed | not listed | not listed |
cost.record | not listed | not listed | not listed |
ledger.export | not listed | not listed | not listed |
09 Communication
Open layerHow do we talk?
| Capability | Description | Access | Emits |
|---|---|---|---|
conversation.create | not listed | not listed | not listed |
conversation.get | not listed | not listed | not listed |
message.send | Send a message into a conversation on behalf of the actor. | Member of the organization | message.sent |
message.list | not listed | not listed | not listed |
notification.send | Notify people or agents about an event. | Member of the organization | notification.sent |
notification.subscribe | not listed | not listed | not listed |
channel.connect | not listed | not listed | not listed |
thread.resolve | not listed | not listed | not listed |
10 Data
Open layerWhat happened, and what do we have?
| Capability | Description | Access | Emits |
|---|---|---|---|
entity.get | not listed | not listed | not listed |
entity.list | not listed | not listed | not listed |
entity.type.define | not listed | not listed | not listed |
event.emit | not listed | not listed | not listed |
event.query | Query events by name, actor, resource and period. | Member of the organization | none (read) |
audit.list | List audited actions for an organization. | Privileged role or approval | none (read) |
report.run | not listed | not listed | not listed |
form.submit | Record a form submission as an entity and emit an event. | Public | form.submitted |
Access
Three access levels
Public capabilities need no identity beyond the public actor. Member capabilities require a relationship with the organization. Privileged capabilities require a role that grants them, or an approval before execution.
- Public: readable by anyone, such as page.get and catalog.list.
- Member of the organization: customer.get, workflow.start, invoice.create.
- Privileged role or approval: site.publish, permission.grant, deployment.rollback.
- Public
identity.currentpage.getcatalog.listcatalog.product.getform.submit- Member of the organization
permission.checkorganization.getcustomer.getlead.listsite.content.updatepage.createworkflow.startcatalog.product.updateorder.updateinvoice.createmessage.sendnotification.sendevent.query- Privileged role or approval
permission.grantmembership.inviterelationship.createagent.owner.setsite.publishapproval.decidedeployment.publishdeployment.rollbackcatalog.product.publishaudit.list
The featured capabilities at each level. The catalogue above lists every name.
Agents
From intent to event
An agent does not call a database. It forms an intent and resolves it to a capability, and CORE does the rest: identity, permission, execution, event. The agent sees the result; the organization sees the audit trail.
- Intent
- Identity
- Permission
- Capability
- Event / Audit