> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reputably.net/llms.txt
> Use this file to discover all available pages before exploring further.

# What agents cannot do

> The permission ceiling, and why it is drawn where it is.

Every credential on this surface, however it authenticated, is clamped to **read plus safe
writes**. The clamp is enforced on the server for each request, so it holds identically
over MCP and over plain HTTP.

## Never available

* **Sending anything to an external platform.** Nothing you do here reaches a customer or
  appears in public: not a reply to a review or a mention, and nothing on any connected
  channel.
* **Triggering a sync** or an AI Visibility run. These are platform-admin actions; the
  schedulers keep data fresh for everyone else, and `get_active_syncs` tells you whether a
  refresh is in flight.
* **Billing**, users, and minting, rotating or revoking credentials.
* **Writing entities directly.** Entity writes are refused for every entity. All changes go
  through named operations.

Drafting is available and sending is not, which is the line the whole surface is drawn on.
An assistant can write the reply; a human reads it, and sends it.

## The two calls that change something a human notices

<CardGroup cols={2}>
  <Card title="apply_tracking_setup" icon="sliders">
    Creates the starter trackers and prompts. Fills empty capacity only, never overwrites
    existing rows, and caps are enforced server-side.
  </Card>

  <Card title="mark_leads_seen" icon="check">
    Marks specific leads triaged. Idempotent, first-seen wins, and unknown ids are skipped
    rather than erroring.
  </Card>
</CardGroup>

Everything else either reads, or produces a draft that sits in the app until a person acts
on it.

## Data that is never readable

Two exclusions are worth naming, because they are not oversights:

* **Agency records.** Reading one decrypts stored secrets, so the entity is blocked outright.
* **Raw AI-traffic events.** The per-hit stream is high volume and visitor-level. The daily
  rollup answers the question the feature exists to answer, and that is what is exposed.

## Why it is an allow-list

The readable entities and callable operations are enumerated, never derived by subtracting
a blocklist. A new endpoint that nobody has classified therefore fails closed: it is
refused until someone deliberately adds it. A forgotten entry costs you a `403` and a bug
report. The other way round, it would cost a silent hole.

This is also why these docs are generated from those same lists. If something is documented
here, a credential can call it; if it is missing, it does not exist.