Story: Safety and Access Control
Story
As Marcus (admin), I'm protected from accidental data changes — writes require confirmation, dangerous operations (email, billing, contracts) are excluded, and the bot only operates in the approved GroupMe group.
Acceptance Criteria
- Bot ignores messages from any group not in the allowlist
- Bot ignores its own messages (no infinite loops)
- Email, billing, contract, and token-generation operations are not available as tools
- All write operations require explicit "yes" confirmation
- Pending confirmations expire after 5 minutes
- Bot authenticates via Keycloak service account, not user credentials
Architecture References
arch: A1 (GroupMe Webhook — group allowlist, self-ignore), A2 (AI Engine — tool exclusions, confirmation flow)