Capability rules
- Read capabilities can usually run without approval.
- Mutating configuration or durable data requires approval.
- Long-running actions have matching wait capabilities.
- Workbench should inspect or search documents before acting on a vague source scope.
- Saving files into Vault is different from using files as temporary Workbench context.
Document and Vault capabilities
Legislate and comparison capabilities
MCP provider capabilities
The provider import path is intentionally bounded: Workbench imports selected files, not entire provider repositories. The backend limits a single import batch to selected files and a total size cap.