Skip to content

ToolApprovalRule

Namespace AgentPrism · Assembly AgentPrism.Abstractions.dll

A persistent approval rule for a tool call the user said “do not ask again” for.

public sealed record ToolApprovalRule : IEquatable<ToolApprovalRule>

objectToolApprovalRule

IEquatable<ToolApprovalRule>

object.GetType(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()

A rule is bound to the triple tenant + agent + tool. An approval given by one tenant does not hold in another tenant; this is a security boundary and is not relaxed.

When ArgumentsHash is populated the rule covers only a call made with the same arguments. When it is empty the rule covers every call of the tool. The distinction exists because Microsoft Agent Framework offers two separate “always approve” forms: CreateAlwaysApproveToolResponse and CreateAlwaysApproveToolWithArgumentsResponse.

ToolApprovalRule.ArgumentConditions is a third, admin-authored form: instead of an exact argument fingerprint it carries a set of comparisons (for example “amount <= 100”) evaluated on every call. It is mutually exclusive with ArgumentsHash.

public ToolApprovalRule()

Gets the agent the rule holds for. When null it covers every agent of the tenant.

public string? AgentName { get; init; }

string?

Gets the argument conditions. All conditions must match for the rule to apply (AND); an empty list matches every call of the tool. Mutually exclusive with ArgumentsHash — a rule carries one or the other, never both.

public IReadOnlyList<ToolArgumentCondition> ArgumentConditions { get; init; }

IReadOnlyList<ToolArgumentCondition>

Gets the argument fingerprint. When it is populated the rule covers only a call made with the same arguments.

public string? ArgumentsHash { get; init; }

string?

Gets the creation time (UTC).

public required DateTimeOffset CreatedAt { get; init; }

DateTimeOffset

Gets who created the rule, or null when there is no authentication.

public string? CreatedBy { get; init; }

string?

Gets the rule id. A time-ordered UUID (v7).

public required Guid Id { get; init; }

Guid

Gets the tenant the rule holds in.

public required string TenantId { get; init; }

string

Gets the tool the rule holds for.

public required string ToolName { get; init; }

string

public override bool Equals(object? obj)

obj object?

bool

public bool Equals(ToolApprovalRule? other)

other ToolApprovalRule?

bool

public override int GetHashCode()

int

public override string ToString()

string

operator ==(ToolApprovalRule?, ToolApprovalRule?)

Section titled “ operator ==(ToolApprovalRule?, ToolApprovalRule?)”
public static bool operator ==(ToolApprovalRule? left, ToolApprovalRule? right)

left ToolApprovalRule?

right ToolApprovalRule?

bool

operator !=(ToolApprovalRule?, ToolApprovalRule?)

Section titled “ operator !=(ToolApprovalRule?, ToolApprovalRule?)”
public static bool operator !=(ToolApprovalRule? left, ToolApprovalRule? right)

left ToolApprovalRule?

right ToolApprovalRule?

bool