37c75867e53dbcb92e1360cfa3a8bbb0fb9c67ae on 2026-10-22. No matching customer Studio operation exists for live.list, live.trace, live.takeOver, or live.approve. This records current reuse boundaries and requirements for ENG-5895, not a callable contract. The inactive inventory is docs/platform-api/proposals/ENG-5853-5859.json.
Account user management and staff approval endpoints do not establish a customer external approver API. The account routes and OpenAPI contain no live Studio operations. Existing conversation and human-ownership APIs are references only.
Future authorization and safety proof
Until P4/P9 decisions are recorded, future writes require an authenticated account administrator resolved throughCurrent.account, or a specifically named account approver for the held action. Resolve every target through that account. An agent/bot cannot decide a held action, and a caller cannot approve its own request.
Future tests must cover account isolation, administrator/approver eligibility, self-approval refusal, refusal-state preservation, expiry and already-resolved conflicts, and replay without duplicate execution or audit. Accepted decisions record actor and prior state. Takeover tests cover both timing choices and outbound effects. Trace/list tests prove customer-content redaction. These are future requirements; this docs slice adds no tests and asserts no current guarantee.
The proposed conversation.taken_over and approval.requested, approval.approved, approval.rejected, and approval.cancelled names remain pending external delivery review. Existing internal cancelled naming is not webhook proof. ENG-5895 reconciles ENG-5298/5256 and I-30/P9/P4. Scopes, events, MCP and SDK exposure remain inactive.