IToolAuthorizationHandler

Namespace AgentPrism · Assembly AgentPrism.Abstractions.dll

Decides whether a tenant/user may call a specific tool.

public interface IToolAuthorizationHandler

Remarks

This is separate from approval (ToolDescriptor.RequiresApproval). Approval asks a human “is this call okay this time”; this interface asks the installation’s own policy “can this caller call this tool at all”. Both can apply to the same tool; when they do, authorization runs first — asking a human to approve a call the caller could never make anyway is backwards.

The default implementation (AllowAllToolAuthorizationHandler, registered with TryAdd) allows every call, so an installation that registers nothing keeps today’s behavior exactly. A consumer replaces the registration to enforce its own rule.

If this handler throws, the call is denied (fail-closed). A gate that fails open on an exception is not a gate.

Methods

AuthorizeAsync(ToolAuthorizationRequest, CancellationToken)

Decides whether the call described by request may proceed.

ValueTask<ToolAuthorizationResult> AuthorizeAsync(ToolAuthorizationRequest request, CancellationToken cancellationToken = default)

Parameters

request ToolAuthorizationRequest

The call being authorized.

cancellationToken CancellationToken

The cancellation token.

Returns

ValueTask<ToolAuthorizationResult>

The decision.