# Project and agent contracts

Choose a supported agent transport for Project resources and understand its authorization and version boundaries.

Canonical: https://commentary.dev/docs/reference/project-agent-contracts


Project-domain integrations expose authenticated HTTP operations and grouped MCP actions for Projects, Trackers, Review packages, Project Review Sessions, source snapshots, and evidence. Exact deployed operations and request shapes are in the generated [HTTP operation reference](/docs/reference/api-operations) and [MCP tool reference](/docs/reference/mcp-operations).

Before writing, read current state and its ETag/version. Supply the exact typed input, conditional version, and idempotency key required by that operation. Keep the same key only for an identical retry. On conflict, preserve the proposed change, reload current data, reconcile, and submit a new intent.

Agent workspace grants, Resource authorization, provider permissions, and user membership are separate. A Resource reference is not an access grant. Agents cannot create human Decisions, alter reviewer eligibility, or assert trusted verification. Provider writes require independent provider write authority.

Use [Project and Tracker automation](/docs/build/projects-trackers), [Project evidence definitions](/docs/reference/project-evidence), and [exact human acceptance](/docs/workflows/request-exact-acceptance) before automating a consequential workflow.