Every scope Relay holds

Eight scopes are held

trigger · starts the run

Six systems, one credential each: a restricted Stripe key, a read-only replica role, an OAuth app per inbox, and one Slack bot token.

Can the scope write?

check · after Eight scopes are held

The credential decides, not the prompt. A read-only role cannot be talked into a write.

Five only read

lookup · after Can the scope write? · branch reads (5 of 8)

Stripe subscriptions and invoices, the accounts replica, the help center and the ticket thread. Nothing they touch changes.

Three can write

step · after Can the scope write? · branch writes (3 of 8)

One reply per ticket, one handoff message, and account credits. Every write is scoped to a single object.

Does the write move money?

check · after Three can write

Two of the three writes only post text. The third is the only path from Relay to your balance.

Two post text

step · after Does the write move money? · branch words (2 of 3)

helpdesk.replies.write posts one reply on one ticket. slack.handoff.write posts into the one channel that owns the account.

One moves money, capped at $50

limit · after Does the write move money? · branch money (1 of 3)

stripe.credits.write is checked against the ceiling in the tool layer, before the call is made.

The refund goes to a person

handoff · after One moves money, capped at $50

ZD-4821 asked for $70.97 against the $50 cap, so the scope was never used and Dana Okonjo answered instead.