Remove legacy rbac

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
2025-12-23 14:42:05 +01:00
parent 799bf6a0ec
commit b7471c97f8
6 changed files with 143 additions and 138 deletions
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -5888,7 +5888,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 			return types.NewControl(control), nil
 		}
 	case coredata.RiskEntityType:
-		action = probo.ActionRiskList
+		action = probo.ActionRiskGet
 		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
 			risk, err := prb.Risks.Get(ctx, id)
 			if err != nil {
--- a/pkg/server/api/mcp/v1/resolver.go
+++ b/pkg/server/api/mcp/v1/resolver.go
@@ -19,45 +19,16 @@ type Resolver struct {
 }

 func (r *Resolver) MustBeAuthorized(ctx context.Context, entityID gid.GID, action iam.Action) {
-	user := connect_v1.IdentityFromContext(ctx)
-	apiKey := connect_v1.APIKeyFromContext(ctx)
-	if user == nil {
-		panic(&iam.TenantAccessError{Message: "authentication required"})
-	}
+	identity := connect_v1.IdentityFromContext(ctx)

-	var credentialID *gid.GID
-	if apiKey != nil {
-		credentialID = &apiKey.ID
-	}
-
-	// When API key is used, fall back to legacy system for intersection semantics.
-	// The legacy system handles API key role checking properly.
-	// TODO: Migrate API key authorization to new system.
-	if credentialID != nil {
-		err := r.iamSvc.LegacyAccessManagementService.Authorize(ctx, user.ID, credentialID, entityID, action)
-		if err != nil {
-			panic(err)
-		}
-		return
-	}
-
-	// Map legacy action to new namespaced action
-	newAction, ok := probo.MapLegacyAction(entityID.EntityType(), action)
-	if !ok {
-		// Fall back to legacy system for unmapped actions
-		err := r.iamSvc.LegacyAccessManagementService.Authorize(ctx, user.ID, credentialID, entityID, action)
-		if err != nil {
-			panic(err)
-		}
-		return
-	}
-
-	// Use new authorizer with mapped action
-	err := r.iamSvc.Authorizer.Authorize(ctx, iam.AuthorizeParams{
-		Principal: user.ID,
-		Resource:  entityID,
-		Action:    newAction,
-	})
+	err := r.iamSvc.Authorizer.Authorize(
+		ctx,
+		iam.AuthorizeParams{
+			Principal: identity.ID,
+			Resource:  entityID,
+			Action:    action,
+		},
+	)
 	if err != nil {
 		panic(err)
 	}
--- a/pkg/server/api/mcp/v1/types/vendor.go
+++ b/pkg/server/api/mcp/v1/types/vendor.go
@@ -53,3 +53,9 @@ func NewAddVendorOutput(v *coredata.Vendor) AddVendorOutput {
 		Vendor: NewVendor(v),
 	}
 }
+
+func NewUpdateVendorOutput(v *coredata.Vendor) UpdateVendorOutput {
+	return UpdateVendorOutput{
+		Vendor: NewVendor(v),
+	}
+}
--- a/pkg/server/api/mcp/v1/schema.resolvers.go
+++ b/pkg/server/api/mcp/v1/schema.resolvers.go
@@ -10,7 +10,6 @@ import (

 	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"go.probo.inc/probo/pkg/coredata"
-	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/mail"
 	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/probo"
@@ -42,7 +41,7 @@ func (r *Resolver) ListOrganizationsTool(ctx context.Context, req *mcp.CallToolR
 // ListVendorsTool handles the listVendors tool
 // List all vendors for the organization
 func (r *Resolver) ListVendorsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListVendorsInput) (*mcp.CallToolResult, types.ListVendorsOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListVendors)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionVendorList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -75,7 +74,7 @@ func (r *Resolver) ListVendorsTool(ctx context.Context, req *mcp.CallToolRequest
 // AddVendorTool handles the addVendor tool
 // Add a new vendor to the organization
 func (r *Resolver) AddVendorTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddVendorInput) (*mcp.CallToolResult, types.AddVendorOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateAsset)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionVendorCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -114,12 +113,32 @@ func (r *Resolver) AddVendorTool(ctx context.Context, req *mcp.CallToolRequest,
 // UpdateVendorTool handles the updateVendor tool
 // Update an existing vendor
 func (r *Resolver) UpdateVendorTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateVendorInput) (*mcp.CallToolResult, types.UpdateVendorOutput, error) {
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionVendorUpdate)

-	return nil, types.UpdateVendorOutput{}, fmt.Errorf("updateVendor not implemented")
+	svc := r.ProboService(ctx, input.ID)
+
+	var description **string
+	if input.Description != nil {
+		description = &input.Description
+	}
+
+	vendor, err := svc.Vendors.Update(
+		ctx,
+		probo.UpdateVendorRequest{
+			ID:          input.ID,
+			Name:        input.Name,
+			Description: description,
+		},
+	)
+	if err != nil {
+		return nil, types.UpdateVendorOutput{}, fmt.Errorf("failed to update vendor: %w", err)
+	}
+
+	return nil, types.NewUpdateVendorOutput(vendor), nil
 }

 func (r *Resolver) ListPeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListPeopleInput) (*mcp.CallToolResult, types.ListPeopleOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListPeople)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionPeopleList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -150,7 +169,7 @@ func (r *Resolver) ListPeopleTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) GetPeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetPeopleInput) (*mcp.CallToolResult, types.GetPeopleOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionPeopleGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -165,7 +184,7 @@ func (r *Resolver) GetPeopleTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) AddPeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddPeopleInput) (*mcp.CallToolResult, types.AddPeopleOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreatePeople)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionPeopleCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -197,7 +216,7 @@ func (r *Resolver) AddPeopleTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) UpdatePeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdatePeopleInput) (*mcp.CallToolResult, types.UpdatePeopleOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdatePeople)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionPeopleUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -224,7 +243,7 @@ func (r *Resolver) UpdatePeopleTool(ctx context.Context, req *mcp.CallToolReques
 }

 func (r *Resolver) ListRisksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListRisksInput) (*mcp.CallToolResult, types.ListRisksOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListRisks)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionRiskList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -255,7 +274,7 @@ func (r *Resolver) ListRisksTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetRiskInput) (*mcp.CallToolResult, types.GetRiskOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionRiskGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -270,7 +289,7 @@ func (r *Resolver) GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, in
 }

 func (r *Resolver) AddRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddRiskInput) (*mcp.CallToolResult, types.AddRiskOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateRisk)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionRiskCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -298,7 +317,7 @@ func (r *Resolver) AddRiskTool(ctx context.Context, req *mcp.CallToolRequest, in
 }

 func (r *Resolver) UpdateRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateRiskInput) (*mcp.CallToolResult, types.UpdateRiskOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateRisk)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionRiskUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -327,7 +346,7 @@ func (r *Resolver) UpdateRiskTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) ListMeasuresTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListMeasuresInput) (*mcp.CallToolResult, types.ListMeasuresOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListMeasures)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionMeasureList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -358,7 +377,7 @@ func (r *Resolver) ListMeasuresTool(ctx context.Context, req *mcp.CallToolReques
 }

 func (r *Resolver) GetMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetMeasureInput) (*mcp.CallToolResult, types.GetMeasureOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionMeasureGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -373,7 +392,7 @@ func (r *Resolver) GetMeasureTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) AddMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddMeasureInput) (*mcp.CallToolResult, types.AddMeasureOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateMeasure)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionMeasureCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -396,7 +415,7 @@ func (r *Resolver) AddMeasureTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) UpdateMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateMeasureInput) (*mcp.CallToolResult, types.UpdateMeasureOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateMeasure)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionMeasureUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -420,7 +439,7 @@ func (r *Resolver) UpdateMeasureTool(ctx context.Context, req *mcp.CallToolReque
 }

 func (r *Resolver) ListFrameworksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListFrameworksInput) (*mcp.CallToolResult, types.ListFrameworksOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListFrameworks)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionFrameworkList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -446,7 +465,7 @@ func (r *Resolver) ListFrameworksTool(ctx context.Context, req *mcp.CallToolRequ
 }

 func (r *Resolver) GetFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetFrameworkInput) (*mcp.CallToolResult, types.GetFrameworkOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionFrameworkGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -461,7 +480,7 @@ func (r *Resolver) GetFrameworkTool(ctx context.Context, req *mcp.CallToolReques
 }

 func (r *Resolver) AddFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddFrameworkInput) (*mcp.CallToolResult, types.AddFrameworkOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateFramework)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionFrameworkCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -483,7 +502,7 @@ func (r *Resolver) AddFrameworkTool(ctx context.Context, req *mcp.CallToolReques
 }

 func (r *Resolver) UpdateFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateFrameworkInput) (*mcp.CallToolResult, types.UpdateFrameworkOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateFramework)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionFrameworkUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -505,7 +524,7 @@ func (r *Resolver) UpdateFrameworkTool(ctx context.Context, req *mcp.CallToolReq
 }

 func (r *Resolver) ListAssetsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAssetsInput) (*mcp.CallToolResult, types.ListAssetsOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListAssets)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionAssetList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -536,7 +555,7 @@ func (r *Resolver) ListAssetsTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) GetAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAssetInput) (*mcp.CallToolResult, types.GetAssetOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionAssetGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -551,7 +570,7 @@ func (r *Resolver) GetAssetTool(ctx context.Context, req *mcp.CallToolRequest, i
 }

 func (r *Resolver) AddAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddAssetInput) (*mcp.CallToolResult, types.AddAssetOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateAsset)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionAssetCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -577,7 +596,7 @@ func (r *Resolver) AddAssetTool(ctx context.Context, req *mcp.CallToolRequest, i
 }

 func (r *Resolver) UpdateAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateAssetInput) (*mcp.CallToolResult, types.UpdateAssetOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateAsset)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionAssetUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -603,7 +622,7 @@ func (r *Resolver) UpdateAssetTool(ctx context.Context, req *mcp.CallToolRequest
 }

 func (r *Resolver) ListDataTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDataInput) (*mcp.CallToolResult, types.ListDataOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListData)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionDatumList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -634,7 +653,7 @@ func (r *Resolver) ListDataTool(ctx context.Context, req *mcp.CallToolRequest, i
 }

 func (r *Resolver) GetDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDatumInput) (*mcp.CallToolResult, types.GetDatumOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionDatumGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -649,7 +668,7 @@ func (r *Resolver) GetDatumTool(ctx context.Context, req *mcp.CallToolRequest, i
 }

 func (r *Resolver) AddDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddDatumInput) (*mcp.CallToolResult, types.AddDatumOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateDatum)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionDatumCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -673,7 +692,7 @@ func (r *Resolver) AddDatumTool(ctx context.Context, req *mcp.CallToolRequest, i
 }

 func (r *Resolver) UpdateDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDatumInput) (*mcp.CallToolResult, types.UpdateDatumOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateDatum)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionDatumUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -697,7 +716,7 @@ func (r *Resolver) UpdateDatumTool(ctx context.Context, req *mcp.CallToolRequest
 }

 func (r *Resolver) ListNonconformitiesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListNonconformitiesInput) (*mcp.CallToolResult, types.ListNonconformitiesOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListNonconformities)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionNonconformityList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -728,7 +747,7 @@ func (r *Resolver) ListNonconformitiesTool(ctx context.Context, req *mcp.CallToo
 }

 func (r *Resolver) GetNonconformityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetNonconformityInput) (*mcp.CallToolResult, types.GetNonconformityOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionNonconformityGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -743,7 +762,7 @@ func (r *Resolver) GetNonconformityTool(ctx context.Context, req *mcp.CallToolRe
 }

 func (r *Resolver) AddNonconformityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddNonconformityInput) (*mcp.CallToolResult, types.AddNonconformityOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateNonconformity)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionNonconformityCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -773,7 +792,7 @@ func (r *Resolver) AddNonconformityTool(ctx context.Context, req *mcp.CallToolRe
 }

 func (r *Resolver) UpdateNonconformityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateNonconformityInput) (*mcp.CallToolResult, types.UpdateNonconformityOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateNonconformity)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionNonconformityUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -803,7 +822,7 @@ func (r *Resolver) UpdateNonconformityTool(ctx context.Context, req *mcp.CallToo
 }

 func (r *Resolver) ListObligationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListObligationsInput) (*mcp.CallToolResult, types.ListObligationsOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListObligations)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionObligationList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -834,7 +853,7 @@ func (r *Resolver) ListObligationsTool(ctx context.Context, req *mcp.CallToolReq
 }

 func (r *Resolver) GetObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetObligationInput) (*mcp.CallToolResult, types.GetObligationOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionObligationGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -849,7 +868,7 @@ func (r *Resolver) GetObligationTool(ctx context.Context, req *mcp.CallToolReque
 }

 func (r *Resolver) AddObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddObligationInput) (*mcp.CallToolResult, types.AddObligationOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateObligation)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionObligationCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -879,7 +898,7 @@ func (r *Resolver) AddObligationTool(ctx context.Context, req *mcp.CallToolReque
 }

 func (r *Resolver) UpdateObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateObligationInput) (*mcp.CallToolResult, types.UpdateObligationOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateObligation)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionObligationUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -909,7 +928,7 @@ func (r *Resolver) UpdateObligationTool(ctx context.Context, req *mcp.CallToolRe
 }

 func (r *Resolver) ListContinualImprovementsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListContinualImprovementsInput) (*mcp.CallToolResult, types.ListContinualImprovementsOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListContinualImprovements)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionContinualImprovementList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -940,7 +959,7 @@ func (r *Resolver) ListContinualImprovementsTool(ctx context.Context, req *mcp.C
 }

 func (r *Resolver) GetContinualImprovementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetContinualImprovementInput) (*mcp.CallToolResult, types.GetContinualImprovementOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionContinualImprovementGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -955,7 +974,7 @@ func (r *Resolver) GetContinualImprovementTool(ctx context.Context, req *mcp.Cal
 }

 func (r *Resolver) AddContinualImprovementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddContinualImprovementInput) (*mcp.CallToolResult, types.AddContinualImprovementOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateContinualImprovement)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionContinualImprovementCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -982,7 +1001,7 @@ func (r *Resolver) AddContinualImprovementTool(ctx context.Context, req *mcp.Cal
 }

 func (r *Resolver) UpdateContinualImprovementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateContinualImprovementInput) (*mcp.CallToolResult, types.UpdateContinualImprovementOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateContinualImprovement)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionContinualImprovementUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -1009,7 +1028,7 @@ func (r *Resolver) UpdateContinualImprovementTool(ctx context.Context, req *mcp.
 }

 func (r *Resolver) ListAuditsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAuditsInput) (*mcp.CallToolResult, types.ListAuditsOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListAudits)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionAuditList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -1035,7 +1054,7 @@ func (r *Resolver) ListAuditsTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) GetAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAuditInput) (*mcp.CallToolResult, types.GetAuditOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionAuditGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -1050,7 +1069,7 @@ func (r *Resolver) GetAuditTool(ctx context.Context, req *mcp.CallToolRequest, i
 }

 func (r *Resolver) AddAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddAuditInput) (*mcp.CallToolResult, types.AddAuditOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateAudit)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionAuditCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -1075,7 +1094,7 @@ func (r *Resolver) AddAuditTool(ctx context.Context, req *mcp.CallToolRequest, i
 }

 func (r *Resolver) UpdateAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateAuditInput) (*mcp.CallToolResult, types.UpdateAuditOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateAudit)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionAuditUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -1100,7 +1119,7 @@ func (r *Resolver) UpdateAuditTool(ctx context.Context, req *mcp.CallToolRequest
 }

 func (r *Resolver) ListControlsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListControlsInput) (*mcp.CallToolResult, types.ListControlsOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListControls)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionControlList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -1131,7 +1150,7 @@ func (r *Resolver) ListControlsTool(ctx context.Context, req *mcp.CallToolReques
 }

 func (r *Resolver) GetControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetControlInput) (*mcp.CallToolResult, types.GetControlOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionControlGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -1146,7 +1165,7 @@ func (r *Resolver) GetControlTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddControlInput) (*mcp.CallToolResult, types.AddControlOutput, error) {
-	r.MustBeAuthorized(ctx, input.FrameworkID, iam.ActionCreateControl)
+	r.MustBeAuthorized(ctx, input.FrameworkID, probo.ActionControlCreate)

 	svc := r.ProboService(ctx, input.FrameworkID)

@@ -1171,7 +1190,7 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateControlInput) (*mcp.CallToolResult, types.UpdateControlOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateControl)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionControlUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -1196,7 +1215,7 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
 }

 func (r *Resolver) LinkControlMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlMeasureInput) (*mcp.CallToolResult, types.LinkControlMeasureOutput, error) {
-	r.MustBeAuthorized(ctx, input.ControlID, iam.ActionCreateControlMeasureMapping)
+	r.MustBeAuthorized(ctx, input.ControlID, probo.ActionControlMeasureMappingCreate)

 	svc := r.ProboService(ctx, input.ControlID)

@@ -1209,7 +1228,7 @@ func (r *Resolver) LinkControlMeasureTool(ctx context.Context, req *mcp.CallTool
 }

 func (r *Resolver) UnlinkControlMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlMeasureInput) (*mcp.CallToolResult, types.UnlinkControlMeasureOutput, error) {
-	r.MustBeAuthorized(ctx, input.ControlID, iam.ActionDeleteControlMeasureMapping)
+	r.MustBeAuthorized(ctx, input.ControlID, probo.ActionControlMeasureMappingDelete)

 	svc := r.ProboService(ctx, input.ControlID)

@@ -1222,7 +1241,7 @@ func (r *Resolver) UnlinkControlMeasureTool(ctx context.Context, req *mcp.CallTo
 }

 func (r *Resolver) LinkControlDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlDocumentInput) (*mcp.CallToolResult, types.LinkControlDocumentOutput, error) {
-	r.MustBeAuthorized(ctx, input.ControlID, iam.ActionCreateControlDocumentMapping)
+	r.MustBeAuthorized(ctx, input.ControlID, probo.ActionControlDocumentMappingCreate)

 	svc := r.ProboService(ctx, input.ControlID)

@@ -1235,7 +1254,7 @@ func (r *Resolver) LinkControlDocumentTool(ctx context.Context, req *mcp.CallToo
 }

 func (r *Resolver) UnlinkControlDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlDocumentInput) (*mcp.CallToolResult, types.UnlinkControlDocumentOutput, error) {
-	r.MustBeAuthorized(ctx, input.ControlID, iam.ActionDeleteControlDocumentMapping)
+	r.MustBeAuthorized(ctx, input.ControlID, probo.ActionControlDocumentMappingDelete)

 	svc := r.ProboService(ctx, input.ControlID)

@@ -1248,7 +1267,7 @@ func (r *Resolver) UnlinkControlDocumentTool(ctx context.Context, req *mcp.CallT
 }

 func (r *Resolver) LinkControlAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlAuditInput) (*mcp.CallToolResult, types.LinkControlAuditOutput, error) {
-	r.MustBeAuthorized(ctx, input.ControlID, iam.ActionCreateControlAuditMapping)
+	r.MustBeAuthorized(ctx, input.ControlID, probo.ActionControlAuditMappingCreate)

 	svc := r.ProboService(ctx, input.ControlID)

@@ -1261,7 +1280,7 @@ func (r *Resolver) LinkControlAuditTool(ctx context.Context, req *mcp.CallToolRe
 }

 func (r *Resolver) UnlinkControlAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlAuditInput) (*mcp.CallToolResult, types.UnlinkControlAuditOutput, error) {
-	r.MustBeAuthorized(ctx, input.ControlID, iam.ActionDeleteControlAuditMapping)
+	r.MustBeAuthorized(ctx, input.ControlID, probo.ActionControlAuditMappingDelete)

 	svc := r.ProboService(ctx, input.ControlID)

@@ -1274,7 +1293,7 @@ func (r *Resolver) UnlinkControlAuditTool(ctx context.Context, req *mcp.CallTool
 }

 func (r *Resolver) LinkControlSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlSnapshotInput) (*mcp.CallToolResult, types.LinkControlSnapshotOutput, error) {
-	r.MustBeAuthorized(ctx, input.ControlID, iam.ActionCreateControlSnapshotMapping)
+	r.MustBeAuthorized(ctx, input.ControlID, probo.ActionControlSnapshotMappingCreate)

 	svc := r.ProboService(ctx, input.ControlID)

@@ -1287,7 +1306,7 @@ func (r *Resolver) LinkControlSnapshotTool(ctx context.Context, req *mcp.CallToo
 }

 func (r *Resolver) UnlinkControlSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlSnapshotInput) (*mcp.CallToolResult, types.UnlinkControlSnapshotOutput, error) {
-	r.MustBeAuthorized(ctx, input.ControlID, iam.ActionDeleteControlSnapshotMapping)
+	r.MustBeAuthorized(ctx, input.ControlID, probo.ActionControlSnapshotMappingDelete)

 	svc := r.ProboService(ctx, input.ControlID)

@@ -1300,7 +1319,7 @@ func (r *Resolver) UnlinkControlSnapshotTool(ctx context.Context, req *mcp.CallT
 }

 func (r *Resolver) ListTasksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListTasksInput) (*mcp.CallToolResult, types.ListTasksOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListTasks)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionTaskList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -1326,7 +1345,7 @@ func (r *Resolver) ListTasksTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) GetTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetTaskInput) (*mcp.CallToolResult, types.GetTaskOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionTaskGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -1340,7 +1359,7 @@ func (r *Resolver) GetTaskTool(ctx context.Context, req *mcp.CallToolRequest, in
 }

 func (r *Resolver) AddTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddTaskInput) (*mcp.CallToolResult, types.AddTaskOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateTask)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionTaskCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -1365,7 +1384,7 @@ func (r *Resolver) AddTaskTool(ctx context.Context, req *mcp.CallToolRequest, in
 }

 func (r *Resolver) UpdateTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateTaskInput) (*mcp.CallToolResult, types.UpdateTaskOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateTask)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionTaskUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -1391,7 +1410,7 @@ func (r *Resolver) UpdateTaskTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) AssignTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AssignTaskInput) (*mcp.CallToolResult, types.AssignTaskOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionAssignTask)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionTaskAssign)

 	svc := r.ProboService(ctx, input.ID)

@@ -1406,7 +1425,7 @@ func (r *Resolver) AssignTaskTool(ctx context.Context, req *mcp.CallToolRequest,
 }

 func (r *Resolver) UnassignTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnassignTaskInput) (*mcp.CallToolResult, types.UnassignTaskOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUnassignTask)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionTaskUnassign)

 	svc := r.ProboService(ctx, input.ID)

@@ -1420,7 +1439,7 @@ func (r *Resolver) UnassignTaskTool(ctx context.Context, req *mcp.CallToolReques
 }

 func (r *Resolver) ListSnapshotsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListSnapshotsInput) (*mcp.CallToolResult, types.ListSnapshotsOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListSnapshots)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionSnapshotList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -1446,7 +1465,7 @@ func (r *Resolver) ListSnapshotsTool(ctx context.Context, req *mcp.CallToolReque
 }

 func (r *Resolver) GetSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetSnapshotInput) (*mcp.CallToolResult, types.GetSnapshotOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionSnapshotGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -1460,7 +1479,7 @@ func (r *Resolver) GetSnapshotTool(ctx context.Context, req *mcp.CallToolRequest
 }

 func (r *Resolver) TakeSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.TakeSnapshotInput) (*mcp.CallToolResult, types.TakeSnapshotOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateSnapshot)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionSnapshotCreate)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -1482,7 +1501,7 @@ func (r *Resolver) TakeSnapshotTool(ctx context.Context, req *mcp.CallToolReques
 }

 func (r *Resolver) ListDocumentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentsInput) (*mcp.CallToolResult, types.ListDocumentsOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListDocuments)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionDocumentList)

 	prb := r.ProboService(ctx, input.OrganizationID)

@@ -1518,7 +1537,7 @@ func (r *Resolver) ListDocumentsTool(ctx context.Context, req *mcp.CallToolReque
 }

 func (r *Resolver) GetDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentInput) (*mcp.CallToolResult, types.GetDocumentOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionDocumentGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -1533,7 +1552,7 @@ func (r *Resolver) GetDocumentTool(ctx context.Context, req *mcp.CallToolRequest
 }

 func (r *Resolver) AddDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddDocumentInput) (*mcp.CallToolResult, types.AddDocumentOutput, error) {
-	r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateDocument)
+	r.MustBeAuthorized(ctx, input.OrganizationID, probo.ActionDocumentCreate)

 	svc := r.ProboService(ctx, input.OrganizationID)

@@ -1562,7 +1581,7 @@ func (r *Resolver) AddDocumentTool(ctx context.Context, req *mcp.CallToolRequest
 }

 func (r *Resolver) UpdateDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDocumentInput) (*mcp.CallToolResult, types.UpdateDocumentOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateDocument)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionDocumentUpdate)

 	svc := r.ProboService(ctx, input.ID)

@@ -1587,7 +1606,7 @@ func (r *Resolver) UpdateDocumentTool(ctx context.Context, req *mcp.CallToolRequ
 }

 func (r *Resolver) ListDocumentVersionsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentVersionsInput) (*mcp.CallToolResult, types.ListDocumentVersionsOutput, error) {
-	r.MustBeAuthorized(ctx, input.DocumentID, iam.ActionDocumentVersion)
+	r.MustBeAuthorized(ctx, input.DocumentID, probo.ActionDocumentVersionList)

 	pageOrderBy := page.OrderBy[coredata.DocumentVersionOrderField]{
 		Field:     coredata.DocumentVersionOrderFieldCreatedAt,
@@ -1612,7 +1631,7 @@ func (r *Resolver) ListDocumentVersionsTool(ctx context.Context, req *mcp.CallTo
 }

 func (r *Resolver) GetDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentVersionInput) (*mcp.CallToolResult, types.GetDocumentVersionOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionDocumentVersionGet)

 	svc := r.ProboService(ctx, input.ID)

@@ -1627,7 +1646,7 @@ func (r *Resolver) GetDocumentVersionTool(ctx context.Context, req *mcp.CallTool
 }

 func (r *Resolver) CreateDraftDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateDraftDocumentVersionInput) (*mcp.CallToolResult, types.CreateDraftDocumentVersionOutput, error) {
-	r.MustBeAuthorized(ctx, input.DocumentID, iam.ActionCreateDraftDocumentVersion)
+	r.MustBeAuthorized(ctx, input.DocumentID, probo.ActionDocumentDraftVersionCreate)

 	svc := r.ProboService(ctx, input.DocumentID)

@@ -1642,7 +1661,7 @@ func (r *Resolver) CreateDraftDocumentVersionTool(ctx context.Context, req *mcp.
 }

 func (r *Resolver) UpdateDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDocumentVersionInput) (*mcp.CallToolResult, types.UpdateDocumentVersionOutput, error) {
-	r.MustBeAuthorized(ctx, input.DocumentVersionID, iam.ActionUpdateDocumentVersion)
+	r.MustBeAuthorized(ctx, input.DocumentVersionID, probo.ActionDocumentVersionUpdate)

 	svc := r.ProboService(ctx, input.DocumentVersionID)

@@ -1663,7 +1682,7 @@ func (r *Resolver) UpdateDocumentVersionTool(ctx context.Context, req *mcp.CallT
 }

 func (r *Resolver) PublishDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishDocumentVersionInput) (*mcp.CallToolResult, types.PublishDocumentVersionOutput, error) {
-	r.MustBeAuthorized(ctx, input.DocumentID, iam.ActionPublishDocumentVersion)
+	r.MustBeAuthorized(ctx, input.DocumentID, probo.ActionDocumentVersionPublish)

 	svc := r.ProboService(ctx, input.DocumentID)

@@ -1681,7 +1700,7 @@ func (r *Resolver) PublishDocumentVersionTool(ctx context.Context, req *mcp.Call
 }

 func (r *Resolver) ListDocumentVersionSignaturesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentVersionSignaturesInput) (*mcp.CallToolResult, types.ListDocumentVersionSignaturesOutput, error) {
-	r.MustBeAuthorized(ctx, input.DocumentVersionID, iam.ActionDocumentVersion)
+	r.MustBeAuthorized(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSignatureList)

 	prb := r.ProboService(ctx, input.DocumentVersionID)

@@ -1714,7 +1733,7 @@ func (r *Resolver) ListDocumentVersionSignaturesTool(ctx context.Context, req *m
 }

 func (r *Resolver) GetDocumentVersionSignatureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentVersionSignatureInput) (*mcp.CallToolResult, types.GetDocumentVersionSignatureOutput, error) {
-	r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
+	r.MustBeAuthorized(ctx, input.ID, probo.ActionDocumentVersionSignatureGet)

 	prb := r.ProboService(ctx, input.ID)

@@ -1729,7 +1748,7 @@ func (r *Resolver) GetDocumentVersionSignatureTool(ctx context.Context, req *mcp
 }

 func (r *Resolver) RequestDocumentVersionSignatureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.RequestDocumentVersionSignatureInput) (*mcp.CallToolResult, types.RequestDocumentVersionSignatureOutput, error) {
-	r.MustBeAuthorized(ctx, input.DocumentVersionID, iam.ActionRequestSignature)
+	r.MustBeAuthorized(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSignatureRequest)

 	svc := r.ProboService(ctx, input.DocumentVersionID)

@@ -1750,7 +1769,7 @@ func (r *Resolver) RequestDocumentVersionSignatureTool(ctx context.Context, req
 }

 func (r *Resolver) DeleteDraftDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDraftDocumentVersionInput) (*mcp.CallToolResult, types.DeleteDraftDocumentVersionOutput, error) {
-	r.MustBeAuthorized(ctx, input.DocumentVersionID, iam.ActionDeleteDraftDocumentVersion)
+	r.MustBeAuthorized(ctx, input.DocumentVersionID, probo.ActionDocumentVersionDeleteDraft)

 	svc := r.ProboService(ctx, input.DocumentVersionID)

@@ -1765,7 +1784,7 @@ func (r *Resolver) DeleteDraftDocumentVersionTool(ctx context.Context, req *mcp.
 }

 func (r *Resolver) DeleteDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDocumentInput) (*mcp.CallToolResult, types.DeleteDocumentOutput, error) {
-	r.MustBeAuthorized(ctx, input.DocumentID, iam.ActionDeleteDocument)
+	r.MustBeAuthorized(ctx, input.DocumentID, probo.ActionDocumentDelete)

 	svc := r.ProboService(ctx, input.DocumentID)

@@ -1780,7 +1799,7 @@ func (r *Resolver) DeleteDocumentTool(ctx context.Context, req *mcp.CallToolRequ
 }

 func (r *Resolver) CancelSignatureRequestTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CancelSignatureRequestInput) (*mcp.CallToolResult, types.CancelSignatureRequestOutput, error) {
-	r.MustBeAuthorized(ctx, input.DocumentVersionSignatureID, iam.ActionCancelSignatureRequest)
+	r.MustBeAuthorized(ctx, input.DocumentVersionSignatureID, probo.ActionDocumentVersionCancelSignature)

 	svc := r.ProboService(ctx, input.DocumentVersionSignatureID)