> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inviolet.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Intent cards

> The unit of authorization declaring what an agent may do, on which columns, under what conditions.

The unit of authorization. An intent card declares what an agent is allowed to
do, the columns it can touch, the conditions that apply, and the response
strategy when it strays.

## The shape

```json theme={"dark"}
{
  "purpose_id": "customer_support_lookup",
  "allowed_actions": [
    { "operation": "postgres.select", "resource_glob": "contacts.*" }
  ],
  "forbidden_actions": [
    { "operation": "postgres.select", "resource_glob": "contacts.ssn" }
  ],
  "scope": {
    "operations": ["postgres.select"],
    "resources": ["contacts.first_name", "contacts.last_name", "contacts.email"]
  },
  "required_context": [
    { "source_card_id": "ctx:on_call", "field": "is_on_call", "required": true }
  ],
  "default_ttl_seconds": 300,
  "max_ttl_seconds": 3600,
  "on_action_outside_scope": "deny",
  "classification": {
    "match_threshold": 0.85,
    "ambiguous_floor": 0.6,
    "route_ambiguous_to_approval": true
  }
}
```

## Lifecycle

1. **Draft** — author the card; it's invisible to the gateway until you save.
2. **Configured** — saved with valid scope. Visible on the dashboard but not yet
   dispensing mandates.
3. **Active** — dispatching mandates on every dispense call.

## Response strategies

The `on_action_outside_scope` field selects the strategy the cascade applies
when an action falls outside the card's scope:

* `deny` — Violet baseline. Block the call.
* `deny_with_reroute` — block + suggest a substitute card.
* `defer` — queue for batch review (Ultraviolet trial).
* `substitute` — swap in a Violet-tier handler (Ultraviolet trial).
* `allow_with_redact` — allow but mask sensitive fields (Ultraviolet trial).
* `allow_with_downgrade` — allow with narrower scope (Ultraviolet trial).

Strategies marked Ultraviolet trial give every customer a 30-day free trial on
first touch. After that they revert to the Violet baseline (`deny` or
`deny_with_reroute`) until the customer upgrades. See
[Trial-everything](/operate/trials).

## Where they live

Intent cards live in the Gallery
([app.inviolet.ai/gallery](https://app.inviolet.ai/gallery)). They're stored in
the `gallery_cards` table with category=`intents`. Each card has a configured
payload validated against `IntentPayloadSchema` from `@inviolet/gallery-cards`.