# Connect system CRUD screens

These screens are intentionally grouped behind one **System** entry point. Every mutation is sent to the Gateway, requires the existing CSRF/session contract, and must remain server-authorized.

| Screen | Resource | Operations | Safety requirements |
| --- | --- | --- | --- |
| Namespaces | `/api/v1/stores/namespaces` | list/create; update/delete when Gateway exposes them | dependency counts, soft disable before hard delete, namespace-scoped authorization |
| Store profiles | `/api/v1/stores/profiles` | list/create, inspect, migrate | migration preview, progress, rollback, optimistic version |
| Object types | `/api/v1/stores/object-types` | list/create/read/update/delete | version type definitions; block deletes with live objects |
| Relationship types | `/api/v1/stores/graphs/relationship-types` | list/create/read/update/delete | source/target validation and existing-edge impact |
| State stores | `/api/v1/stores/state` | list/create; key/value CRUD below each store | retention/compaction preview; protect system stores |
| Gateway connection | `/api/v1/gateway/config/current` | read/validate/update | validate-before-apply, audit, rollback, never expose secrets |
| Access & roles | external identity + Gateway policy | review mappings and scope | provider owns users; Gateway remains authoritative for authorization |

## Cross-cutting acceptance criteria

- All writes use Gateway authorization and CSRF protection.
- Forms show server validation errors and dependency impact before destructive actions.
- Mutations are audited with actor, timestamp, resource, before/after, and correlation ID.
- Edits use optimistic concurrency/version tokens.
- Schema and configuration changes are reversible and produce a health event.
- The System landing page remains usable when one resource API is unavailable.