← All practicals

Authorize a tool call, not just a prompt

Invoke a fixed MCP tool catalog — every call is gated on scope, agent liveness, and, when delegated, the whole chain.

1. 1

   On the MCP lab, pick one of your active agents and invoke a tool it holds the scope for (e.g. search_docs).

   Every invocation is authorized against the acting identity’s scopes BEFORE the (simulated) tool ever runs — the server checks required_scope against what the agent actually holds, not what the prompt asked for.

2. 2

   Now invoke a tool your agent was never granted (e.g. transfer_funds) and watch it get denied.

   A missing scope is a 403 scope_denied — the tool never executes, and the denial itself is audited (mcp.denied), same as an allowed call is (mcp.invoked).

3. 3

   On the A2A lab, delegate an ATTENUATED token that drops a scope your agent HAD, then invoke that same tool with the token instead of the agent.

   The delegated call is authorized against the TOKEN’S scope claim, not the root agent’s full scopes — an attenuated capability is denied exactly where a wider one would have been allowed, proving attenuation reaches all the way to the tool call.

4. 4

   Kill any one agent in that delegation chain (root, middle, or leaf), then invoke again with the same token.

   Every hop is re-resolved live on every invocation — one killed link anywhere in the chain fails the call with chain_inactive, the same kill-switch propagation the A2A lab’s introspection proves, now reaching a real tool execution.