Default-deny model

FlowCP follows a default-deny principle: every tool is disabled when first created and must be explicitly enabled before AI clients can invoke it.

Why default deny?

When FlowCP imports your Swagger/OpenAPI spec, it may find dozens or hundreds of endpoints. Automatically enabling all of them would expose every API operation to AI clients — including internal admin endpoints, destructive operations, or endpoints that are not intended for external access.

Default deny means:

• You review and consciously enable only the endpoints you want AI clients to use

• A newly imported endpoint can never be invoked until a human turns it on

• Adding a new endpoint to your API does not automatically expose it — it starts disabled and waits for review

How it applies

Event	Default state
New import — endpoint discovered for the first time	Disabled
Re-import — existing endpoint already customized	Unchanged (your settings are preserved)
Re-import — new endpoint found that did not exist before	Disabled
DELETE endpoint	Disabled, with Require confirmation defaulted to on
New skill authored	Disabled until you turn it on

Enabling tools

Enable a tool from the Tools tab by toggling the switch on its row. You can enable multiple tools at once using the toolbar's bulk controls.

Workspace isolation

The default-deny model is enforced at the workspace level. A tool in workspace A can never be invoked by a request authenticated to workspace B. Every storage lookup in FlowCP is scoped to the requesting workspace — this is not just a UI concern but is enforced in every database query.

Runtime enforcement

Even if a tool's database record is marked enabled, the runtime re-validates the state on every incoming request. If a tool is disabled between requests, the next call is rejected without making an upstream API call.