feat: declare a risk tier on every command in the catalog

467 of the 1592 commands carried no `risk:`. An unset risk is read as
destructive by the agent approval gate, so half the catalog's write side sat
behind the same prompt — and, in HarfangLab's case, 39 pure lookups did too.
A gate that stops everything stops being read as a signal, which is the
argument already made for the toolkit and for sentinelone (df27876).

The catalog is now 1027 read, 261 safe_write, 304 destructive, with nothing
defaulted. The line follows the one sentinelone drew: impact on the estate,
not reversibility — isolate-agent is reversible and is the canonical
destructive example.

  read        only queries; changes nothing outside Riposte
  safe_write  additive or reversible inside the tool's own case/enrichment
              plane: comments, tickets, tags, alert statuses, threat-intel
              records, sandbox submissions, collection jobs, outbound messages
  destructive changes the estate or weakens a control: containment, blocklists
              and allowlists, exclusions and detection rules, every delete,
              identity and credential operations, code on a host, generic
              API escape hatches

Three calls that were not obvious, and are now applied throughout:

- Undoing a containment is tiered like the containment it lifts. Un-isolating
  a host or un-banning an IP mid-incident is its own decision, not a return to
  a neutral state. The catalog contradicted itself here — crowdstrike's
  lift_containment was destructive while harfanglab's deisolate_from_threat
  was safe_write — so deisolate_from_threat and unquarantine_file are
  re-tiered to destructive, the only two existing tiers this pass changes.
- Retrieving a live secret is destructive: cyberark get_password, delinea
  get_secret, vault read_secret, beyondtrust get_credential. It is a GET, but
  the tier describes the stake, not the HTTP verb.
- Sending outward to humans stays safe_write — slack, teams, twilio, telegram,
  mail. Irreversible, but it is the collaboration plane, not the estate.

An object created but not yet referenced by a rule is safe_write; editing one
a rule already reads is destructive. That is why fortigate create_address and
panos create_custom_url_category are safe_write while update_address_group and
edit_custom_url_category are not.

The template and README never documented the field, which is how 467 commands
came to omit it. Both now carry the tier table and these rules, so the next
integration declares a tier instead of inheriting one.

111 packages get a MINOR bump and a changelog entry: an instance compares
versions to offer an update, so an unbumped manifest would leave the tiers
sitting in the catalog and never reaching the estates that need them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

integrations/active-directory/manifest.yaml

@@ -1,8 +1,8 @@
 id: active_directory
 name: Active Directory
-version: 1.0.0
+version: 1.1.0
 description: "Active Directory over LDAP/LDAPS — query and manage users, computers, groups and contacts (search, enable/disable/unlock, set/expire password, group membership, OU moves, create/update/delete). Runs on a remote engine inside the AD network. Requires the Python 'ldap3' library on the engine host (pip install ldap3)."
-changelog: "1.0.0 — Initial release: full directory administration over LDAP (search, get user/computer/group-members, create/update/delete user/contact/group, enable/disable/unlock, set/expire password, password-never-expire, add/remove group membership, move user/computer OU, test credentials)."
+changelog: "1.1.0 — Declare the risk tier on the 18 commands that carried none: 3 safe_write, 15 destructive. An unset risk is read as destructive by the agent approval gate, so the 3 that only annotate sat behind the same prompt as the ones that change the estate. | 1.0.0 — Initial release: full directory administration over LDAP (search, get user/computer/group-members, create/update/delete user/contact/group, enable/disable/unlock, set/expire password, password-never-expire, add/remove group membership, move user/computer OU, test credentials)."
 category: identity
 
 # Per-instance configuration. The integration binds to a Domain Controller over
@@ -139,6 +139,7 @@ commands:
   - id: ad_enable_account
     name: ad-enable-account
     description: "Enable a previously disabled user account."
+    risk: destructive
     inputs_schema:
       properties:
         username: { type: string, description: "sAMAccountName of the account to enable" }
@@ -149,6 +150,7 @@ commands:
   - id: ad_disable_account
     name: ad-disable-account
     description: "Disable a user account."
+    risk: destructive
     inputs_schema:
       properties:
         username: { type: string, description: "sAMAccountName of the account to disable" }
@@ -158,6 +160,7 @@ commands:
   - id: ad_unlock_account
     name: ad-unlock-account
     description: "Unlock a locked-out user account."
+    risk: destructive
     inputs_schema:
       properties:
         username: { type: string, description: "sAMAccountName of the account to unlock" }
@@ -167,6 +170,7 @@ commands:
   - id: ad_set_new_password
     name: ad-set-new-password
     description: "Set a new password for a user. Requires a secure connection (SSL or TLS)."
+    risk: destructive
     inputs_schema:
       properties:
         username: { type: string, description: "sAMAccountName whose password will be set" }
@@ -177,6 +181,7 @@ commands:
   - id: ad_expire_password
     name: ad-expire-password
     description: "Force a user to change their password at next login."
+    risk: destructive
     inputs_schema:
       properties:
         username: { type: string, description: "sAMAccountName of the user" }
@@ -186,6 +191,7 @@ commands:
   - id: ad_modify_password_never_expire
     name: ad-modify-password-never-expire
     description: "Set or clear the 'Password Never Expire' flag on a user account."
+    risk: destructive
     inputs_schema:
       properties:
         username: { type: string, description: "sAMAccountName of the user" }
@@ -197,6 +203,7 @@ commands:
   - id: ad_add_to_group
     name: ad-add-to-group
     description: "Add a user, computer or nested group to a group."
+    risk: destructive
     inputs_schema:
       properties:
         username: { type: string, description: "Username(s) to add (single or CSV). Mutually exclusive with computer-name." }
@@ -209,6 +216,7 @@ commands:
   - id: ad_remove_from_group
     name: ad-remove-from-group
     description: "Remove a user or computer from a group."
+    risk: destructive
     inputs_schema:
       properties:
         username: { type: string, description: "Username to remove. Mutually exclusive with computer-name." }
@@ -222,6 +230,7 @@ commands:
   - id: ad_modify_user_ou
     name: ad-modify-user-ou
     description: "Move a user to a different organizational unit within the domain."
+    risk: destructive
     inputs_schema:
       properties:
         user-name: { type: string, description: "Name of the user to move" }
@@ -232,6 +241,7 @@ commands:
   - id: ad_modify_computer_ou
     name: ad-modify-computer-ou
     description: "Move a computer to a different organizational unit within the domain."
+    risk: destructive
     inputs_schema:
       properties:
         computer-name: { type: string, description: "Name of the computer to move" }
@@ -244,6 +254,7 @@ commands:
   - id: ad_create_user
     name: ad-create-user
     description: "Create a user account, set its initial password and enable it. Requires a secure connection (SSL or TLS)."
+    risk: destructive
     inputs_schema:
       properties:
         username: { type: string, description: "sAMAccountName for the new user" }
@@ -260,6 +271,7 @@ commands:
   - id: ad_update_user
     name: ad-update-user
     description: "Replace a single attribute on an existing user."
+    risk: destructive
     inputs_schema:
       properties:
         username: { type: string, description: "sAMAccountName of the user" }
@@ -271,6 +283,7 @@ commands:
   - id: ad_delete_user
     name: ad-delete-user
     description: "Delete a user (or any object) by its DN."
+    risk: destructive
     inputs_schema:
       properties:
         user-dn: { type: string, description: "DN of the object to delete" }
@@ -281,6 +294,7 @@ commands:
   - id: ad_create_contact
     name: ad-create-contact
     description: "Create a contact object."
+    risk: safe_write
     inputs_schema:
       properties:
         contact-dn: { type: string, description: "Full DN of the new contact" }
@@ -295,6 +309,7 @@ commands:
   - id: ad_update_contact
     name: ad-update-contact
     description: "Replace a single attribute on an existing contact."
+    risk: safe_write
     inputs_schema:
       properties:
         contact-dn: { type: string, description: "DN of the contact" }
@@ -307,6 +322,7 @@ commands:
   - id: ad_create_group
     name: ad-create-group
     description: "Create a security or distribution group."
+    risk: safe_write
     inputs_schema:
       properties:
         name: { type: string, description: "Group name (sAMAccountName)" }
@@ -318,6 +334,7 @@ commands:
   - id: ad_update_group
     name: ad-update-group
     description: "Replace a single attribute on an existing group."
+    risk: destructive
     inputs_schema:
       properties:
         groupname: { type: string, description: "Group name (cn) to update" }
@@ -329,6 +346,7 @@ commands:
   - id: ad_delete_group
     name: ad-delete-group
     description: "Delete a security or distribution group by its DN."
+    risk: destructive
     inputs_schema:
       properties:
         dn: { type: string, description: "DN of the group" }