Change plan authority

Recommended

With your coding agent

Paste this into Claude Code, or another coding agent, in the repository where your agent runs. It already contains this card's agent name, domain and limit.

Connect my agent to its KIFF card, so the agent asks KIFF before it acts and only acts when KIFF allows it.

Card: card-plan-changes
Agent name, sent as actor_id: support-agent
Domain: subscription-plan-change
Action: CHANGE_PLAN (change subscription plans)
Limit: 40 per calendar day, counted per authorized action

Steps:
1. Find the place in this codebase where the agent performs this action. Explain it to me before changing anything.
2. Just before it runs, call POST https://api.kiff.dev/v1/proposals/decide with header "Authorization: Bearer $KIFF_CLOUD_API_KEY" and this JSON body:
   {"action_name": "CHANGE_PLAN", "actor_id": "support-agent", "domain": "subscription-plan-change", "entity_id": "<the subscription id>", "entity_type": "Subscription", "parameters": {"target_plan":"<target_plan>"}}
3. Run the action only when the response's "outcome" is "allowed". On anything else, do not run it and surface "reasons" and "message" (for example mandate_limit_reached means the card's limit would be exceeded).
4. KIFF decides against the entity's current state, so the system must also report that entity's events to POST https://api.kiff.dev/v1/events/raw?domain=subscription-plan-change. Check with me which events we already emit.
5. Read the key from the environment variable KIFF_CLOUD_API_KEY and never hard-code it. Ask me for it. The key must hold the "support" role, or KIFF refuses the action on permissions before it checks the card (I can create one with that role on the card's page in KIFF). It must also be the key issued for support-agent: KIFF refuses a key issued for another agent (actor_not_key_holder), and a key not issued for any agent wherever a card is drawn on (key_not_bound_to_agent).
6. Add a test for the allowed and the refused path.

Reference: https://kiff.dev/docs/five-line-integration and https://kiff.dev/llms.txt