One-install Autodesk front door over 8 bounded official domain packs and 8 non-chat, uncached, read-only workflows. It admits 105 of 146 operations from all 8 schemas in Autodesk's official OpenAPI repository at commit 84312395ae1912104e6b52813df0900fb4ed4818. Forty-one explicit exclusions cover OAuth/secret lifecycle, one unsupported HEAD binding, two binary image uploads, and application-only OSS, Secure Service Account, and app-wide webhook operations that cannot run honestly through the current user-delegated connection. The admitted surface covers ACC project/account administration and issues plus APS identity, Data Management, Model Derivative, and webhook administration. Reads are uncached; sensitive reads are marked sensitive-read and require approval unless session-granted, while ordinary reads remain unheld. Every mutation requires approval, unsafe JSON integers remain exact, and every leaf is pinned to its immutable official schema. No task, note, or project Source is claimed without live field-path proof.