[requires: account.view_self] Show the authenticated user, their role, and effective capabilities resolved from the role graph.

[requires: account.view_self] Render the role inheritance graph and where the current user sits in it.

[requires: account.update_self] Update your own profile (name and/or avatar URL).

[requires: users.list] List workspace users.

[requires: users.invite] Invite a user to the workspace with a given role.

[requires: users.remove] Permanently remove a user from the workspace.

[requires: users.suspend] Suspend a user (blocks sign-in, keeps their data).

[requires: users.activate] Re-activate a previously suspended user.

[requires: users.change_role] Change another user's workspace role.

[requires: docs.search] Full-text search across documents you can access.

[requires: docs.read] Read a document by ID.

[requires: docs.create] Create a document in a collection.

[requires: docs.update] Update a document's title and/or text.

[requires: docs.delete] Delete a document.

[requires: audit.read] Read the workflow audit trail: every tool call, who made it, and at which stage it succeeded or was denied.