Define Markitect action vocabulary

examples/markitect/protected_system_manifest.yaml

@@ -3,6 +3,92 @@ name: Markitect Tool
 description: Markitect protected-system namespace for flex-auth.
 caring_profiles:
   - caring-0.4.0-rc2
+actions:
+  - name: read
+    capabilities:
+      - View
+    planes:
+      - Data
+    exposure_modes:
+      - Metadata
+      - Masked
+      - Plaintext
+  - name: query
+    capabilities:
+      - ViewCollection
+      - Observe
+    planes:
+      - Data
+    exposure_modes:
+      - Metadata
+      - Aggregated
+      - Masked
+  - name: search
+    capabilities:
+      - ViewCollection
+      - Observe
+    planes:
+      - Data
+    exposure_modes:
+      - Metadata
+      - Aggregated
+      - Masked
+  - name: package
+    capabilities:
+      - Create
+      - Bind
+      - ViewCollection
+    planes:
+      - Intent
+      - Data
+    exposure_modes:
+      - Metadata
+      - Masked
+  - name: activate_context
+    capabilities:
+      - Use
+      - Execute
+    planes:
+      - Intent
+      - Policy
+    exposure_modes:
+      - Metadata
+      - Masked
+  - name: export
+    capabilities:
+      - Export
+    planes:
+      - Data
+      - Audit
+    exposure_modes:
+      - Exportable
+      - Plaintext
+  - name: workflow_run
+    capabilities:
+      - Execute
+      - Operate
+    planes:
+      - Execution
+      - Data
+      - Audit
+    exposure_modes:
+      - Metadata
+      - Masked
+      - Plaintext
+  - name: admin
+    capabilities:
+      - Configure
+      - Grant
+      - Revoke
+      - Audit
+    planes:
+      - Configuration
+      - Identity
+      - Policy
+      - Audit
+    exposure_modes:
+      - Metadata
+      - Plaintext
 resource_types:
   - name: knowledge_base
     scope_level: Workspace