{
  "schema": "longtermcapabilities-agent-tool-contract-template/v1",
  "version": "1.64.0",
  "releaseId": "lts-1.64.0-upgrade-safe-rewrites-and-privacy-erasure-integrity",
  "generated": "2026-08-03T20:40:00Z",
  "path": "/insights/agent-tool-contracts/",
  "template": {
    "schema": "longtermcapabilities-agent-tool-contract/v1",
    "tool_id": "example.customer-record.read",
    "version": "1.0.0",
    "owner_role": "Customer Data Service Owner",
    "purpose": "Read one authorized customer record for a named case.",
    "prohibited_uses": [
      "bulk export",
      "cross-tenant lookup",
      "use without a case identifier"
    ],
    "effect_class": "observe",
    "identity": {
      "preserve_originating_principal": true,
      "workload_identity_required": true,
      "delegation_chain_required": true
    },
    "authorization": {
      "resource": "customer_record",
      "operations": [
        "read"
      ],
      "constraints": [
        "tenant",
        "case_id",
        "record_id",
        "purpose",
        "expiry"
      ],
      "approval": "policy-gateway"
    },
    "input_schema": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "tenant_id",
        "case_id",
        "record_id"
      ],
      "properties": {
        "tenant_id": {
          "type": "string",
          "minLength": 1
        },
        "case_id": {
          "type": "string",
          "minLength": 1
        },
        "record_id": {
          "type": "string",
          "minLength": 1
        }
      }
    },
    "result": {
      "accepted_is_not_verified_effect": true,
      "verification": "returned record identifier and source version"
    },
    "idempotency": {
      "required": false,
      "reconciliation": "not applicable for read-only operation"
    },
    "budgets": {
      "max_calls_per_task": 3,
      "timeout_ms": 3000,
      "max_result_bytes": 65536
    },
    "errors": [
      "rejected",
      "not_found",
      "not_authorized",
      "timeout",
      "unknown"
    ],
    "audit": {
      "required_fields": [
        "trace_id",
        "task_id",
        "principal_id",
        "workload_id",
        "policy_decision_id",
        "tool_version",
        "record_id_hash",
        "outcome"
      ],
      "capture_payload_by_default": false
    },
    "change_policy": {
      "reopen_release_on": [
        "new operation",
        "broader scope",
        "new effect class",
        "authorization change",
        "schema breaking change"
      ]
    }
  },
  "fieldRegister": [
    {
      "field": "tool_id",
      "purpose": "Stable identifier for the capability, independent of a display label.",
      "evidence": "Versioned registry entry and owning team."
    },
    {
      "field": "purpose_and_prohibited_use",
      "purpose": "States the business capability and explicitly disallowed uses.",
      "evidence": "Approved use boundary and reviewer roles."
    },
    {
      "field": "principal_and_workload_identity",
      "purpose": "Preserves the originating person or service and the executing workload identity.",
      "evidence": "Authenticated identity chain and revocation path."
    },
    {
      "field": "authorization",
      "purpose": "Defines resource, operation, scope, tenant, amount, time, and environment constraints.",
      "evidence": "External policy decision and least-privilege token or capability."
    },
    {
      "field": "input_schema",
      "purpose": "Constrains accepted arguments and rejects ambiguous or extra fields.",
      "evidence": "Machine-validatable schema and adverse test cases."
    },
    {
      "field": "effect_class",
      "purpose": "Classifies the operation as observe, propose, mutate, communicate, execute code, or transfer value.",
      "evidence": "Consequence rating and required approval mode."
    },
    {
      "field": "idempotency_and_reconciliation",
      "purpose": "Prevents duplicate effects and defines how unknown completion is resolved.",
      "evidence": "Idempotency key, status lookup, and reconciliation test."
    },
    {
      "field": "success_and_verification",
      "purpose": "Separates an accepted request from a verified business effect.",
      "evidence": "Independent verification query or returned durable identifier."
    },
    {
      "field": "error_model",
      "purpose": "Defines rejected, retriable, terminal, partial, and unknown-result states.",
      "evidence": "Typed errors, retry budget, and stop conditions."
    },
    {
      "field": "budgets",
      "purpose": "Bounds calls, elapsed time, data volume, value, messages, and monetary cost.",
      "evidence": "Enforced limits and limit-exceeded tests."
    },
    {
      "field": "audit_and_retention",
      "purpose": "Records the minimum evidence needed for accountability without defaulting to sensitive payload capture.",
      "evidence": "Trace identifiers, policy result, effect identifier, and retention rule."
    },
    {
      "field": "version_and_change_policy",
      "purpose": "Prevents silent contract drift and states which changes reopen evaluation.",
      "evidence": "Semantic version, compatibility policy, and change record."
    }
  ],
  "boundary": "Template only; adapt identity, authority, effect, evidence, retention, and domain obligations to the actual system."
}