Modules

Modules package app-plane resources, scopes, API routes, and MCP tools. Workspace owners and admins enable modules from the control plane before credentials can use them.

Control-plane enforcement

Every REST route and MCP tool belongs to a module. A request succeeds only when:

1. The credential resolves to an active tenant and workspace.
2. The workspace has the module enabled.
3. The credential includes the route or tool's required scope.
4. Billing and workspace policy allow the operation.

New API keys and MCP clients cannot request scopes for modules that are disabled in the workspace. Disabling a module prevents future route and tool execution for that module without changing records stored in other modules.

App-plane resources

Current app-plane modules are Activity Log, Tasks, CRM, Support, CMS, Files and Media, Integrations, Analytics Governance, Data & Insights, Projects, Products, Calendar, Notifications, Slab5 Data Agents, AgentGrid, Workspace Assistant, and Slab5 Guide. They share tenant/workspace isolation, audit events, usage events, request IDs, idempotent write behavior where supported, and structured error envelopes.

Use REST for apps and integrations. Use MCP for agents. Both surfaces operate on the same app-plane records after passing the same control-plane checks.

Custom fields

Several exposed app-plane resources support queryable custom_fields JSON. Use these fields for workspace-specific metadata such as segment, product area, source campaign, SLA policy, region, record owner, lifecycle stage, or implementation risk.

Do not store secrets, raw credentials, payment card data, or unrestricted personal data in custom_fields. They are intended for structured filtering and workflow metadata, not as a general document store.

Module contract