Truto Safe Admin Operator

Truto Safe Admin Operator

Mission

Make Truto CLI changes auditable and reversible. This skill is a safety wrapper around any command that changes state or triggers external side effects.

Mutating Surface

Treat these as mutating: create, update, delete, override-*, refresh-credentials, create-token, link-tokens create, sync-job-runs create, trigger schedule, webhook/notification test, integrations build --yes, file uploads, and data-plane create/update/delete/custom write methods.

Approval Rule

If the user explicitly asked you to make the change, proceed after preflight. If the user asked to "review", "audit", "plan", "check", or "dry run", do not mutate. Provide the ready command and ask for approval only if execution is necessary.

Preflight

truto whoami -p "$PROFILE" -o json --no-color
truto "$RESOURCE" get "$ID" -p "$PROFILE" -o json --no-color > /tmp/truto-before.json

For integrations:

truto integrations validate "$INTEGRATION_ID" -p "$PROFILE" -o json --no-color

For local config:

jq . "$CONFIG_FILE" >/dev/null
truto integrations validate --file "$CONFIG_FILE" -p "$PROFILE" -o json --no-color

Change Design

• Patch the smallest field set.
• Include current version for resources that need optimistic locking.
• Use --stdin or -b "$JSON" rather than interactive prompts.
• Use environment integration override helpers instead of replacing full override blobs.
• Save important before/after JSON to /tmp if the payload is large.
• Never paste secrets in final output.

Apply Templates

Update:

truto "$RESOURCE" update "$ID" -p "$PROFILE" -o json --no-color -b "$PATCH_JSON"

Create:

truto "$RESOURCE" create -p "$PROFILE" -o json --no-color -b "$BODY_JSON"

Environment override:

truto environment-integrations override-auth "$ENV_INTEGRATION_ID" --stdin -p "$PROFILE" -o json --no-color

Delete requires exact target verification and explicit user intent:

truto "$RESOURCE" delete "$ID" -f -p "$PROFILE" -o json --no-color

Verify

truto "$RESOURCE" get "$ID" -p "$PROFILE" -o json --no-color
truto capabilities "$ACCOUNT_OR_INTEGRATION" --target "$TARGET_KIND" -p "$PROFILE" -o json --no-color
truto logs --log-type unified_proxy_api --start "$START" --end "$END" -p "$PROFILE" -o json --no-color

Use resource-specific verification too: show-override, accounts tools, integrations validate, a safe proxy/unified list, or run/log status.

Output

Report preflight, exact change, command run or ready command, verification, rollback note, and any residual risk. If no mutation happened, make that explicit.