Tool registry, identity, and authorization

Tool registry

Every available tool should have an owner, purpose, input and output schema, identity, permitted callers, resources, side effects, data classes, network destinations, credentials, timeout, retry and idempotency behavior, approval requirement, evidence, version, and revocation state.

Tool descriptions shown to a model are not the control source. The execution broker should resolve a stable tool identity and enforce server-side policy.

Identity chain

Keep the initiating actor, agent run, orchestrator, tool broker, and target service distinguishable. Delegated authority must be narrower than the actor's full access and valid only for the intended action, resource, purpose, audience, and time.

Action authorization

Validate typed arguments, current permission, resource state, data classification, policy version, budgets, prerequisite approval, and conflict or duplication before execution. Recheck after a long planning delay or changed target state.

Revocation and failure

Make tool and credential revocation effective for new and active runs. Define behavior for unknown tools, schema mismatch, expired approval, unavailable policy, partial success, timeout, retry, and contradictory results. Non-idempotent actions must not be retried blindly.