Skill governance

Skills spread fast once people can write and share them. This page is the one-screen summary of how Harriet keeps that sharing governed: what gates exist, who holds them, and what gets recorded.

Everything deployable passes review

A skill or MCP connector cannot reach a device until it is approved. Every authoring path feeds the same review queue: the skill editor's Save and submit for review, Skilify submissions from devices and browsers, Session distiller uploads, and unapproved connectors. Skilify submissions never auto-publish, even when the submitter is an account owner. Provisioning only ships skills that are both active and approved, and the same bar applies to the requestable catalog in My AI.

Direct assignments are person-scoped

Teams receive capabilities only through profiles; assigning a skill directly to a team is rejected. A direct skill assignment always names one person, whether it comes from Manage → Assignments or from an approved skill request. This keeps the two access routes legible: broad access is a reviewed profile decision, and every exception is a named individual you can list.

Deactivating a skill pulls it back

Only active skills are provisioned. Deactivate a skill and it drops out of desired state; enrolled devices check in every five minutes and remove it on their next sync, with no per-device cleanup. Built-in default skills follow the same rule: deleting one deactivates it rather than removing the row, so it stops deploying but can be restored.

Every tool call is audited per skill

Tool calls from provisioned skills pass through Harriet's MCP proxy, and each call is written to an append-only audit log: who called which tool, from which device, through which skill and connector, and whether it succeeded. Storing full tool arguments and results is off by default; turning it on is restricted to account owners, and viewing that data requires its own explicit permission on top of audit access. Governance is therefore not just a gate at approval time — you can see what an approved skill actually did afterwards.

Delegation stays inside guardrails

You can name management groups on a profile so team leads maintain it without any console-wide admin role. Delegates edit the profile's contents — its skills, settings, and transport overrides — but they cannot change who receives the profile, create or delete profiles, or touch the default flag. Those remain with full provisioner managers, so a delegated team lead can tune their team's toolkit without being able to widen its audience. See Delegated profile management.

Updates re-enter review without downtime

An approved skill offers two update paths. Save changes (live) edits the running version directly, for people trusted to publish. Propose update for review creates a draft clone that goes through the review workflow like any new submission, while the approved version keeps running unchanged for everyone who has it. Approval swaps the reviewed update in. Improvement never has to race against availability: the fleet stays on the vetted version until a reviewer says otherwise.