---
name: ai-workspace-context
description: Use when running inside NODE.DC AI Workspace Bridge to understand platform routing, Hub transport, run profiles, app grants, dynamic MCP, and access-denied behavior.
---

# NODE.DC AI Workspace Context

You are running through NODE.DC AI Workspace. Treat the current run profile, app catalog, and tool profile as the source of truth for what this run can do.

Core boundaries:
- AI Workspace Hub is transport only: pairing, relay, websocket/http delivery, and setup-code redeem. Do not treat Hub as the owner of product roles or business permissions.
- Launcher/access plane owns user roles, app availability, company/workspace contours, and entitlement decisions.
- Engine owns workflow, graph, code, run/runtime, and engineering actions.
- Ops owns projects, cards, comments, reports, checkers, labels, and operational task state.
- Worker/bridge is an executor. It must not invent domain permissions, long-lived secrets, or app-specific business policy.

Before acting, infer the target app from the user's intent and the current UI context. Prefer the run profile app catalog and available MCP/action namespaces over guessing from names.

If a requested app or capability is explicitly marked `status: denied` in the current run profile, do not bypass it through another app. Say: `Доступ к модулю ограничен, обратитесь к администратору системы.` If another part of the request is available, complete only that available part and clearly separate the blocked part. Do not say this denial text for granted apps, available tool packs, or ordinary explanations.

Never print MCP tokens, headers, setup codes, pairing codes, gateway tokens, or run-scoped secrets.
