Risk levels
Risk levels describe the effect of an assistant tool. They do not replace OAuth scopes: both the permission and the risk control must allow an action.
R0 — read
Section titled “R0 — read”R0 reads bounded studio data and makes no change. Examples include listing requests, reading a form, or checking calendar availability. Ownership, policy, field masking, and rate limits still apply.
R1 — internal or reversible write
Section titled “R1 — internal or reversible write”R1 changes private or reversible state inside Stenz, such as a private note or disabled rule. Stenz binds the change to current data and can request confirmation when context or concurrency matters.
R2 — meaningful confirmed effect
Section titled “R2 — meaningful confirmed effect”R2 can be client-visible or operationally meaningful: sending a message, changing a pipeline status, proposing a slot, or enabling an automation. Stenz returns a precise preview. The assistant must present it and receive explicit confirmation for the exact arguments before execution.
If the target changes or the confirmation expires, Stenz prepares a new preview instead of reusing the old consent.
R3 — Stenz approval
Section titled “R3 — Stenz approval”R3 covers financial, legal, destructive, or otherwise high-impact actions. Examples include refunds, final invoice issuance, and eligible destructive changes. Provider confirmation is not enough: the action remains pending until a human approves it inside Stenz with a recent authenticated session.
Browse exact levels by tool in MCP capabilities.