Foundation decisions

Baseline: Platform main at f0125a735ff1dff5687a8438c464863836315bfd.

ADR-024 is proposed. Shared semantic operations and WebMCP remain separate proposals, outside this foundation.

Foundation boundary

WorkOS authentication and trusted tenant/environment/resource binding establish the connection.
Tenant activation and mcp:read are required for protected MCP use. The write-permission tool also requires mcp:write.
Both tools return fixed, bounded messages. They read no inventory, mutate no business data and emit no business events.
Semantic commands/queries, generated business tools, browser refactoring, WebMCP and event-envelope changes are excluded.
Operational attribution records the verified human/client context. Delegation is not proof that the human approved each action.
Any later business exposure needs separately adopted shared-operation architecture and reviewed domain authorization/provenance.

Resolved direction

The first version uses the person's MCP permissions for the tenant across their connected clients. Separate read-only/write limits for individual clients are deferred.

This delivery introduces Platform's first WorkOS feature flag: Remote MCP access for organizations, with slug entitlement-remote-mcp-org, to control MCP availability for a tenant. Tenant access is resolved after authentication without assuming permissions, groups or flags are present in the Connect token. A bounded tenant-disable delay is accepted; the actual bound must still be selected and verified.

The proposal uses WorkOS's organization-flags API and existing role-permission lookup. The separate activation-file/revision/acknowledgement proposal is withdrawn. Credential expiry during an admitted request remains an open Program design issue.

The foundation is evaluated through the manual client checks and technical tests. A separate business-user trial belongs with future inventory or query functionality, where participants can evaluate real tasks rather than fixed permission tools.

Design findings

Review finding	Documentation resolution	Implementation evidence
Tenant-disable freshness and failures	WorkOS organization capability and user authority resolved after authentication, with optional bounded access-snapshot reuse and recorded withdrawal delay.	Planned; WorkOS API documented, integration and actual bounds unverified.
Lost consent attribution	Verified WorkOS `sid` becomes typed `consentId`, preserved through internal credentials/context and safe operational attribution, with round-trip/negative tests.	Planned; no codec/context change or test execution.
Permission-denial recovery	Stable user/tenant `403` reasons and administrator recovery, distinct from `401` credential renewal, actual OAuth scope deficit and dependency `503`.	Response-fixture experiments show client presentation of 403/503 explanations; real WorkOS recovery is separate implementation work.
Navigation-coupled permissions	Proposed core permission catalog, compatible navigation references, bootstrap-owned export and non-granting provisioning checks.	Planned; existing registry and tooling unchanged.

Open decisions and evidence

The working tool names are hello_read and hello_write. Select the production client/environment, owners/appetite, authority and withdrawal bounds and operating limits before dependent work. Response experiments record the observed local client presentation; they do not exercise WorkOS authentication or authorization. Use the implementation test plan for the integrated foundation, including real authentication recovery.