Tool Permission Management

What it is

Deciding, for each attempted invocation, whether this caller may perform this action with these arguments at this moment — and enforcing the answer somewhere the model cannot influence. It covers the subjects a decision is made about, the granularity at which rules are written, where in the invocation path the decision point sits, which actions require a human to confirm, and how a denial is recorded and communicated.

Why it matters

An agent is a caller whose next action is chosen by a language model from text that may have been written by someone hostile. Every other control assumes it knows who is doing what; this is the one that says no. It is also the capability that makes autonomy affordable: with a reliable, argument-aware decision point, a system can be allowed to act freely within a small envelope rather than requiring supervision for everything, which is the only way an agent gets to be useful without being dangerous.

Permission and credential are different questions

Permission asks whether the call should be allowed. Credentials are what prove the caller's identity to the far side once it is. They fail differently and in opposite directions: a correct permission decision with a missing credential produces an unhelpful error, while a valid credential with no permission check produces exactly the action an attacker wanted, with perfect authentication. A system holding one broad credential can still enforce fine-grained permission in front of it; a system with per-user credentials and no decision point cannot restrict anything a user could theoretically do themselves.

Key decisions

• The granularity of a rule. Naming a tool is easy to write and too coarse for anything consequential; predicates over argument values — which account, which amount, which repository — are where the real distinctions live and where the maintenance burden is.
• Which subject the decision is about: the human the session belongs to, the agent identity acting for them, or the intersection. The intersection is almost always correct and is the one most often skipped.
• Where the decision point sits. It belongs between the emitted call and its dispatch, with no path around it, and it must be the same point for every caller including internal ones.
• Which actions require confirmation by a person, and what that person is shown. A confirmation that summarises is not a confirmation of what will execute.
• What a denial looks like to the model: a terminal failure, or a message it can respond to by proposing a different action. The second is more useful and leaks more about what exists.
• The default for a tool nobody has written a rule for. Default-deny forces a decision at registration time; default-allow means the envelope expands silently with every release.
• How a granted exception expires. Permissions without a lifetime accumulate permanently.

Failure modes

• The restriction is expressed in the system prompt, and a model that is persuaded, jailbroken, or simply confused calls the tool anyway.
• Approval is granted once and interpreted as covering a session, so a later action the user never saw executes under a consent given for something else.
• The confirmation dialog displays a human-readable summary while the executed payload is reconstructed separately, and the two diverge — the approved action and the performed one are not the same.
• The decision is made when the tool is selected, arguments change before dispatch, and the check never runs again on what was actually sent.
• Confirmations are requested so often that users approve reflexively, which converts a control into a latency tax with no safety value.
• An agent acting on a user's behalf is given a service identity broader than that user's own rights, and becomes a route to data the user could not otherwise reach.
• Denial messages name tools and parameters that do not appear in the allowed set, turning the permission system into a discovery oracle for whoever is probing it.
• Rules are evaluated against a stale copy of group membership, so revoked access keeps working until a cache expires.
• A multi-step plan is approved in outline, and each step then executes without its own check because the plan was already blessed.

Related capabilities

• MCP Authentication — establishes the identity a rule is written about
• Credential and Secret Management — custody of what proves that identity downstream
• Tool Registry — supplies the effect metadata rules depend on
• Tool Execution Sandbox — contains what a permitted call can reach
• Function Calling — emits the invocations this capability adjudicates

Applies: Production readiness · Design questions