What each area opens

Every capability toggle, the tier it belongs to, its default, and the tools it advertises.

Each toggle below gates one group of tools. The defaults follow the tiers: reading and configuring are open once the master switch is on, everything that reaches live equipment is a deliberate opt-in. A disabled area's tools are not advertised at all, so an agent connected to this station sees exactly the list you allowed.

Allowed areas

Toggle	Tier	Default	Tools it advertises
Connector (read)	Read	on	`connector_browse`, `tag_read`, `server_status`, `modbus_server_status`, `station_broker_status`, `mqtt_publish_list`, `remote_access_devices`
Connector (configure)	Configure	on	`driver_capabilities`, `serial_line_list`, `serial_line_upsert`, `serial_line_delete`, `mqtt_broker_list`, `mqtt_broker_upsert`, `mqtt_broker_delete`, `mqtt_publish_upsert`, `mqtt_publish_delete`, `device_upsert`, `device_delete`, `tag_upsert`, `tag_delete`, `server_start`, `server_stop`, `server_restart`, `server_list_upsert`, `server_list_delete`, `modbus_server_configure`, `modbus_map_upsert`, `modbus_map_delete`, `station_broker_configure`, `remote_access_device_update`
Connector (operate)	Operate	off	`connector_refresh`, `device_discover`
Logic (read)	Read	on	`logic_browse`, `logic_read`
Logic (configure)	Configure	on	`variable_upsert`, `variable_delete`, `action_upsert`, `action_delete`, `trigger_upsert`, `trigger_delete`, `alarm_upsert`, `alarm_delete`, `logic_folder_upsert`, `logic_folder_delete`
Logic (operate)	Operate	off	`variable_write`, `tag_write`, `action_run`, `alarm_ack`, `alarm_ack_all`
Logs (read)	Read	on	`logs_read`, `event_history_read`
Dashboard (configure)	Configure	on	`dashboard_list`, `dashboard_upsert`, `dashboard_delete`, `component_upsert`, `component_delete`, `connection_upsert`, `connection_delete`
Process (read)	Read	on	`process_models`, `process_runs`, `process_run`, `process_samples`, `unit_status`
Process (configure)	Configure	off	`process_view_configure`
Process (operate)	Operate	off	`process_snapshot`, `process_evaluate`, `process_recipe_apply`, `process_start`, `process_stop`, `process_hold`, `process_resume`, `process_abort`, `process_comment`, `process_report`, `process_run_delete`
UI (automate)	Operate	off	`ui_state`, `ui_navigate`, `ui_screenshot`, `ui_scroll`, `ui_set_theme`, `ui_resize`, `ui_click`, `ui_set_text`, `ui_select`
Backups (manage)	Configure	on	`backup_create`, `backup_list`
Backups (restore)	Restore	off	`backup_restore`
Settings (manage)	Configure	off	`settings_read`, `localization_set`, `asset_list`, `asset_import`, `symbol_validate`, `symbol_import`
Reports (draft)	Read	on	`report_draft`

Connector (configure) reaches beyond the station itself: an agent that turns the Modbus server on with modbus_server_configure lets any machine on the network read what its register map serves and write the rows that allow writing. The Agent page says so under the toggle.

Reports (draft) is in the Read tier and on by default, on a station that existed before it as well, because it changes nothing at the station and sends nothing: report_draft opens the report form at the station filled in, and only the person there sends it.

Two tools are in no area: help_search and help_read, which read the app's own documentation for the installed version. No toggle gates them; they are advertised whenever the master switch is on, because they show nothing of the station. They are described under Help.

What each of those tools actually does, with the arguments it takes and what it refuses, is the tool reference.