Agent tool permissions

Agent tool permissions and scopes

• A Permission Diff for Tool Schemas: Claim vs. Behaviour
• Agent Tool Permissions: A Scope Matrix Your Team Can Enforce
• How to Scope an Agent's Data Access to a Policy Tier
• Testing a Scope Matrix with Deliberate Overreach Probes
• When Two Agents Share a Tool: Scoping Permissions by Caller
• Assigning an Owner and Review Date to Every Scope Matrix Row
• Booking Agent Write Permissions: Scopes, Limits and Approvals
• Coverage Gap Check for Scope Probes: What Synthetic Callers Miss
• All of Agent tool permissions

MCP servers and integrations

Connecting MCP servers and integrations

• How to Audit an MCP Server's Data Access Before You Connect It
• A Provider-Agnostic Tool Schema: What to Normalize, What to Keep
• A Test Suite for Tool-Calling Agents Without the Tool
• How to Version an Agent's Tool Schema Without Breaking Live Runs
• How to Write a Security Review for an Agent Integration
• Normalizing Tool Schemas Without Losing Strictness
• Prompt Injection Through a Tool's Error Message
• Reading a Vendor's MCP Server Logs: What to Look For
• All of MCP servers and integrations

Approvals for agent actions

Approvals and gated agent actions

• Confirmation Rules for Agent Actions That Move Money
• When a Tool Must Reject a Caller: Writing the Denial Response
• Writing the Approval Request a Human Can Answer in Ten Seconds
• A Five-Minute Triage for Escalated Agent Actions
• An Approval Log Schema That Survives a Workflow Change
• Designing a One-Screen Approval Queue for Agent Actions
• Designing an Approval Queue That Makes Reading the Default
• Replaying a Gated Action in Staging Before It Reaches Production
• All of Approvals for agent actions

Safe agent writes

Safe writes and idempotency

• Adding a Verify Step to an Agent's Tool Calls Before It Acts
• Detecting and Resolving Double Bookings Automatically
• Idempotency Keys for Agent Writes: Guards and Retries
• Keeping the Booking Calendar and the AI Front Desk in Sync
• Writing a Conflict-Resolution Policy for Agent Actions
• A Fault Injection Checklist for Agent Write Paths
• A Guard Clock: Expiring Stored Keys Without Dropping a Live Retry
• Designing the Read-Back an Agent Does Before It Writes
• All of Safe agent writes

Tool call logs

Tool call logs and caller identity

• Shadowing an Agent's Tool Calls Without Letting It Act
• A Log Schema That Shows an Agent Stayed Inside Its Scopes
• A Recording Proxy for Tool Calls: Logging Without Changes
• A Tool-Call Log Field List That Proves Which Caller Acted
• A Tool-Call Log Schema That Supports Shadow Comparison
• A Tool's Request Log: Fields That Show Which Agent Called
• Instrumenting an Agent's Tool Calls Without Leaking Customer Data
• Logging Agent Writes: Fields That Show What Changed
• All of Tool call logs