Organization + Project
Every request stays inside an explicit tenant and project scope.
HOW VENTRO WORKS
One set of rules.
Every operating channel.
People, the built-in operator and external agents reach the same application services. No interface gets a private shortcut around permissions, policy or audit.
WEB UIAI OPERATORAPI / MCPONE CONTROL PLANE
HIGH-IMPACT CHANGE
Meaningful changes stay reviewable.
Risk determines the path. Reading can proceed within scope; material writes require a visible plan and accountable approval.
- 01Plan
Describe intended change, scope, impact and rollback.
- 02Approve
An authorized person accepts the exact plan before execution.
- 03Apply
Execute idempotently through the shared service boundary.
- 04Verify
Record the result, evidence and recovery state.
BOUNDARIES BY DEFAULT
Connection does not mean automatic access.
Data stays purpose-bound
Consent and customer information do not silently cross products or channels.
Least privilege
Agents receive bounded capabilities, not owner-equivalent access.
Audit + verification
Sensitive operations leave an attributable result without exposing protected values.
SAFETY CLASSES
The stronger the impact, the stronger the control.
- ReadExecute within scope
- DraftCreate and audit
- Reversible writePlan; approve when material
- High impactExplicit approval + audit
- DestructiveApproval + re-authentication + recovery
CURRENT BOUNDARY
This page explains the operating model. It does not grant access, execute a tool or enable an integration.
See evidence details