Network and tool policy
Authorize exact product tools and destinations without granting general provider access.
Outcome
Each attempt can call only named, schema-validated product tools and network destinations inside its current policy, budget, approval, and generation.
Prerequisites
Classify each tool as read, write, execute, external side effect, credentialed, or destructive. Define argument constraints, data destinations, approval mode, rate/cost limit, and idempotency semantics.
Steps
- Generate only the allowed remote tool definitions for the attempt.
- Bind the capability to workspace, project, run, attempt, generation, tool IDs, normalized arguments, expiry, nonce, budget, audience, and policy version.
- Consume one-use authority atomically at the trusted gateway.
- Execute credentialed side effects outside the sandbox.
- Record the exact external request identity and reconcile ambiguity before retry.
Network denial must be effective at the selected provider/class/image, not merely written in configuration. Package registries and general internet access remain denied unless the task policy explicitly admits them.
Verify
Reject forged, replayed, expired, revoked, cross-attempt, cross-workspace, over-budget, approval-mismatched, and argument-mutated grants. Direct provider and arbitrary host canaries must fail.
Recover
On unexpected egress or tool authority, pause the attempt and revoke its generation. Rotate any affected credential, reconcile external mutations by idempotency identity, and retain the attempt as failed diagnostic evidence.