Static ReadonlyAuthorizesChanges only the caller's own User-scope forms and panels, with the caller's permissions.
Whether this action can bound what it returns to an audience (RunActionParams.Audience): everyone
besides the caller who will see its output, such as the other participants of a shared conversation.
false by default, and the engine enforces it: when a run's audience adds a reader beyond the caller,
ActionEngineServer.RunAction refuses the action with result code AUDIENCE_UNSUPPORTED, without running
it. Override to return true only when the action honours the audience in full — every record, snippet
and count it returns is something every reader may see (pass the audience to the search engine, check each
reader's entitlement to anything it scopes by, and leave out aggregates computed before that filtering).
ProtectedInternalInternal method that must be implemented by derived action classes. This is where the actual action logic should be implemented.
The action execution parameters including typed context
Promise resolving to the action result
Executes the action with the provided parameters.
The action execution parameters including context
Promise resolving to the action result
Create a net-new form contribution for the requesting user.
Reads the registration intent from
spec.formContribution(slot, key, claims, presentation, title). Writes aMJ: Componentsrow (Type='Widget', v1.0.0, Draft) and aMJ: Entity Form Contributionsrow (Scope='User', Status='Pending'). Activation is a separate step (Activate Form Contribution Version), which the "Add to my form" apply flow runs immediately after Create.Security clamp — Scope. This action always writes
Scope='User',UserID=ctx.user.ID. An agent cannot write Global or Role contributions that would change other users' forms. Promotion is a deliberate human act.Precedenceis honored when supplied (the apply flow passesincumbent + 1after the user confirms replacing an installed contribution). It only ever affects the calling user's own form, so it is not clamped.Atomicity. The spec's claim is checked (INVALID_CLAIM) before anything is written, and the Component and row inserts run in one entity transaction, so a refused row leaves no Component behind.