Authorize ASB Agentic Systems Architect

-- Run in the ASB Agentic Operations project. -- This creates the minimum authorization gate used by the consent frontend. create table if not exists operations.mcp_principals ( user_id uuid primary key references auth.users(id) on delete cascade, principal_key text not null unique, principal_type text not null check (principal_type in ('HUMAN','AGENT_SERVICE')), architecture_role text not null check (architecture_role in ('ARCHITECT_ADMIN','ARCHITECT_READ')), enabled boolean not null default true, created_at timestamptz not null default now(), updated_at timestamptz not null default now() ); alter table operations.mcp_principals enable row level security; -- No direct SELECT policy is required by the consent app. It checks via this RPC. -- SECURITY DEFINER is intentional here so the caller can ask only one question: -- "is my authenticated user authorized to use this MCP?" create or replace function public.asb_can_use_architecture_mcp() returns boolean language sql stable security definer set search_path = pg_catalog, public, operations as $$ select exists ( select 1 from operations.mcp_principals p where p.user_id = auth.uid() and p.enabled = true and p.architecture_role in ('ARCHITECT_ADMIN','ARCHITECT_READ') ); $$; revoke all on function public.asb_can_use_architecture_mcp() from public; grant execute on function public.asb_can_use_architecture_mcp() to authenticated; -- Insert your human principal AFTER you know the Supabase Auth user UUID. -- Replace values before running this statement: -- insert into operations.mcp_principals(user_id, principal_key, principal_type, architecture_role, enabled) -- values ('YOUR-AUTH-USER-UUID', 'autumn', 'HUMAN', 'ARCHITECT_ADMIN', true) -- on conflict (user_id) do update set -- principal_key=excluded.principal_key, -- principal_type=excluded.principal_type, -- architecture_role=excluded.architecture_role, -- enabled=excluded.enabled, -- updated_at=now();