Govern MCP tool calls by identity

A tool call is not a message. It changes state: it files a ticket, edits a record, sends a message, runs a query. Once agents can call tools, the question stops being "what did the model say" and becomes "what was permitted to happen, on whose authority".

The short answer#

• Treat tool calls as governed actions with an identity, not as part of the conversation.
• Decide per identity which tools are allowed, and which arguments are acceptable.
• Keep one policy surface instead of per-client allowlists that drift.
• Record tool name, caller, decision and outcome - without storing the payload.

How to do it in AI-FW#

1. Register the client. MCP tools reach AI-FW through the same authenticated path as any other caller, so the agent has an identity (API key, JWT, or certificate) rather than a shared token.
2. Scope tools to groups. Put agents with similar jobs in a group and attach tool policy to the group. A support agent and a finance agent should not inherit the same tool set by accident.
3. Decide by tool and argument. Allow a search tool for everyone, restrict a write tool to a specific group, and mask or block sensitive argument patterns. Policy is data, not code, so it changes without a deployment.
4. Keep inspection in the path. Prompts and responses are still scanned, so a tool call cannot become a way to smuggle content past the guardrails.
5. Use the same audit trail. Every invocation lands in the transaction record with the identity and the decision, so a single query answers who called which tool.

Verify it works#

• Call a blocked tool and confirm the refusal comes back as a policy decision, not a client-side error.
• Check Audit Logs for the tool name, the caller and the outcome.
• Review which identities actually invoke write tools; unused privileges are the easiest thing to remove.

Related#

• MCP tools
• Agents reference
• A2A agent protocol

Frequently asked questions#

Can we allow a tool for one agent group only?

Yes. Tool policy attaches to identities and groups, so a support agent and a finance agent can have different tool sets without a per-client allowlist.

Are tool arguments inspected?

Yes. A tool call passes through the same inspection as any other request, so content cannot be smuggled past the guardrails through a tool invocation.