Authority and effects
A tool schema defines accepted arguments. A tool’s effect classification defines replay and mutation risk. A policy determines whether an invocation may proceed. A human approval grants authority for a bounded action. Each answers a different question.
Use a protected action as an example
Section titled “Use a protected action as an example”An order tool can accept proposal_id in a valid JSON object while still lacking permission to execute that proposal. A prompt saying “ask first” helps model behavior, but runtime policy must enforce the gate. A durable approval should bind the actual action and identities being authorized.
External content may supply facts without supplying authority. Treat a customer message, web page or tool result according to its origin. Keep application-selected tools, policy and credential boundaries outside model-controlled prose.
Execution and infrastructure
Section titled “Execution and infrastructure”Native Python tools are trusted application code running in the host process. Invocation policy does not sandbox their Python implementation. Tools that execute untrusted code require an appropriate runner and explicit execution boundary. Read environments for workspace, runner, artifact and credential roles.
Verify the gate
Section titled “Verify the gate”Test a denied or paused request, an authorized request and a stale or mismatched approval. Independently inspect the downstream effect. The human input guide and durable operations guide explain the supported APIs.