Authorization for tool calls (and, opt-in, resource reads and prompt gets): decides :allow, :ask or :deny for one call.

Evaluation is pure: no I/O, no processes, no telemetry. It runs in the caller, on the final arguments (after pre-hooks), and returns a ConduitMcp.Client.Policy.Decision carrying the matching rule's id and a closed reason atom for the pipeline's telemetry.

policy =
  ConduitMcp.Client.Policy.compile(
    deny: ["*/delete_*", "shell/*"],
    ask: ["github/create_*", {"fs", ~r/^write/}],
    allow: ["github/get_*", {:all, ["fs/*", {:annotation, :read_only, true}]}],
    trusted: ["fs"]
  )

ConduitMcp.Client.Policy.evaluate(policy, call, tool, %{has_approver?: true})

Precedence (PO-1)

Fixed and not configurable: deny > pin > ask > allow > default. List order and rule specificity never change the outcome; a narrow allow cannot carve an exception out of a broad deny. Within one list, list order only picks which rule_id is reported.

Rules

Every rule matches the structured target {server_id, name}, one segment at a time, never a namespaced string (PO-3), so server a_b + tool c and server a + tool b_c are never confused.

• "server/tool" - * globs within one segment; a bare "tool" means any server.
• {server, %Regex{}} - the regex is matched against the tool name; server is a segment glob.
• fn %ConduitMcp.Client.Tool{}, ctx -> boolean end.

• {:annotation, :read_only | :destructive | :open_world | :idempotent, boolean}

  • compares the tool's effective annotation (see "Annotations").
• {:args, fun} - fun.(args) or fun.(args, ctx) on the call's final arguments; ConduitMcp.Client.Policy.Paths builds path predicates.
• {:all, [rule, ...]} - matches when every member matches, for example {:all, ["fs/write", {:args, Paths.inside("path", "/data")}]}.
• {:rule, id, rule} - any rule above with an explicit rule_id (an atom or a string); otherwise the id is {list, index}.

Function rules get the pipeline ctx, including ctx.server_id (where the call goes) and ctx.taint (the servers whose output is in the model's context, HB-3); tainted/1 builds the common taint rule.

With :resources / :prompts in :scope, these also apply:

• "resource:server/uri" (glob on the URI; * may span /), {:resource, server, %Regex{}}
• "prompt:server/name", {:prompt, server, %Regex{}}

Tool rules never match resources or prompts and vice versa. Server ids never contain :, so a server segment with : is rejected (this catches "resource:repo://x", which needs a server: "resource:*/repo://x").

Asymmetric matching (PO-5)

Deny and ask rules match loosely: both segments are compared Unicode lower-cased with -, . and _ equivalent, and a regex is tried against both the name and that folded form. So deny: ["*/delete_repo"] also denies Delete_Repo, delete-repo and DELETE.REPO. Allow rules match exactly and case-sensitively: allow: ["*/delete_repo"] does not allow Delete_Repo.

Failing predicates

Function, argument and annotation predicates run in the caller. A predicate that raises, exits, throws or returns a non-boolean counts as matching in deny and ask lists (reason: :predicate_failed) and as not matching in the allow list: failures never widen access.

Annotations (PO-8)

Tool annotations are untrusted unless the server is listed in :trusted. For an untrusted server every annotation rule sees the conservative value regardless of the hints: not read-only, destructive, open-world, non-idempotent. For a trusted server the boolean hint is used, with the spec defaults when absent, and a read-only tool is not destructive.

Pinning and new tools (PO-6)

The pipeline passes the approved baseline in ctx[:approved_fingerprints]: a map {server_id, tool_name} => fingerprint (ConduitMcp.Client.Fingerprint). A missing key is treated as an empty map (every tool is new), which fails closed.

• pin_tools: true (default) - a tool whose current fingerprint (tool.fingerprint, or computed from tool.raw when nil) differs from its approved one is decided by the pin, right after deny rules: :ask (or :deny without an approver), source: :pin, reason: :definition_changed.
• allow_new_tools: false (default) - a tool with no approved fingerprint is matched only by exact allow rules: a string rule whose server and tool segments are both literal ("fs/read"), or an :all containing one. Globs, bare names, regexes, functions and annotation or argument predicates do not allow it; it falls through to the default. Deny and ask rules apply to new tools as usual.

Default and approvers (PO-2)

ctx[:has_approver?] (default false) tells evaluation whether an approver (on_ask) will run. Without one, evaluation never returns :ask: an ask rule becomes :deny with reason: :no_approver, the pin and an :ask default become :deny with their own reasons. The no-match default is default: :ask (the default; :deny without an approver) or default: :deny.

Runtime updates

update/2 stores a compiled policy in :persistent_term under {ConduitMcp.Client.Policy, name}, and get/1 reads it in the caller. There is no server process. :persistent_term updates are global and trigger a scan of every process's heap, so update rarely (operator changes, "always allow" persistence), not per call.