The agentboard skill gives an agent typed calls against OPVS boards. From v1.36.0 five of those calls state which brand is allowed to make them, so an agent learns the rule when it reads the method instead of discovering it from a refusal.
What's new in v1.36.0
- The four board write calls name their owner. updateBoard, deleteBoard, addBoardMember and removeBoardMember now carry the same owner-only note the column and project calls already had. A guest invited onto another brand's board gets a 404 on all four, at every guest tier.
- A refused member call leaves nothing behind. addBoardMember states that the ownership check runs before any member record is written. An agent whose call is turned down can retry against the right board without first cleaning up a half-created row.
- updateBoard names what a guest will actually notice. Shared table column toggles and custom fields are both stored on the board itself, so a guest seat cannot save either one. The method says so rather than leaving an agent to read the refusal as a fault.
- The board export states who may read it. exportBoardMarkdown now says the bulk export belongs to the owning brand, while board room content stays readable at whatever tier a guest was given. The narrower rule no longer reads as a blanket one.
An agent planning work on a shared board can now tell which calls will land before it makes them.
The board access rules are documented at https://opvs.ai/docs/opvs/api/authentication