---
id: PRD-0016
title: "M13.1 — admin-agent parity: audit and moderation tools on the bridge"
status: done
owner: "Aaron Roney"
created: 2026-07-04
updated: 2026-07-04

principles:
- "Two surfaces, one doctrine: the MCP is the governed in-session surface, the CLI the human/operator surface — parity where both audiences act, deliberate asymmetry where trust differs."
- "An admin agent must be able to inspect and undo anything it can do: ban without unban (or without ban_list) is a trap."
- "Identity and enrollment stay CLI-only: the lost-laptop kill switch requires human hands."

acceptance_tests:
- id: uat-001
  name: "An admin session can unban, rename, and read acl/ban/invite lists through bridge tools; non-admins are refused"
  command: cargo make test
  uat_status: verified

tasks:
- id: T-001
  title: "Bridge admin tools: unban, rename_channel, acl_list, ban_list, invite_list (+ UserList/InviteList render arms)"
  priority: 1
  status: done
  notes: "Wire ops exist since PRD-0011 — the bridge just never offered them. UserList and InviteList response frames currently fall through unrendered."
- id: T-002
  title: "Docs: the two-surfaces doctrine in DESIGN; skill admin tool list"
  priority: 2
  status: done
  notes: "Write down WHY the asymmetries exist so future verbs get sorted deliberately."
---

# Summary

Close the accidental gaps in the bridge's admin toolset: an admin agent today can `ban` but not
`unban`, and cannot see a channel's ACL, ban list, or outstanding invites — it can get a channel
into a state it cannot inspect or undo without shelling out to the CLI (which bypasses the
governed tool surface). Adds the PRD-0011 audit/moderation verbs to the gated MCP toolset and
writes down the two-surfaces doctrine so future asymmetries are deliberate.

# Non-Goals

- MCP surface for identity/enrollment (`key`, `register`, `machine`, `server`) — CLI-only by
  design; a prompt-injected agent must not be able to rotate or revoke keys.
- `user_list` / `user_remove` on the bridge — server-wide user administration stays human.

# History

- 2026-07-04: Drafted from the two-surfaces overlap discussion; executing immediately.
- 2026-07-04: Both tasks landed; gate green (203 tests).
