25ENFORCEMENT

Tool & API Controls

Permissions should attach to specific capabilities, not vague application access.

Priority: P0
Phase: MVP
Primary owner: Platform / Integrations
Status: Blueprint

Objective

Agents gain power through tools. Agent Trust Cloud must inventory tool capabilities and govern individual operations, not just decide whether an agent may access an application. Read customer vs. delete customer are radically different authorities.

What to build

Canonicalize tool metadata: provider, server, operation, parameters, side effects, sensitivity and reversibility.
Separate read, create, update, delete, execute, grant, transfer, publish and admin operations.
Support parameter-level policy such as refund amount, recipient domain or database table.
Maintain tool allowlists and deny lists per agent or trust tier.

Implementation decisions

Discover tools from MCP schemas, OpenAPI specs, SDK instrumentation and connector metadata.
Mark destructive/irreversible operations for stricter default policy.
Record tool schema version because capabilities can expand after approval.
Alert when a tool gains new sensitive functions.

Definition of done

Security can answer exactly which actions each agent can perform.
A tool schema change triggers review when authority expands.
Policies can constrain one parameter without blocking the entire tool.

Success metrics

Tools inventoried
Sensitive operations protected
Unauthorized tool attempts
Schema-change alerts

AUTHORITY MODEL

Permissions should attach to specific capabilities, not vague application access.