The action-authority matrix

planner: model (claude-sonnet-5)manual search: local stubtickets and parts: synthetic training dataMCP 2026-07-28

Write this table before the agent, not after it. Every row is enforced by pipeline/policy.py at run time — the table on this page is rendered from the same object the guardrail consults, so it cannot drift from the behaviour.

Tool	Authority	Approver	Rationale and conditions	What the annotations alone imply
`check_availability` /mcp/parts	automatic	—	Point-in-time stock read.	`automatic`
`find_part` /mcp/parts	automatic	—	Catalogue read. Does not reserve stock or commit spend.	`automatic`
`get_ticket` /mcp/tickets	automatic	—	Single-record read. Same taint as search. Result is tainted as untrusted content.	`automatic`
`post_ticket_update` /mcp/tickets	automatic	—	Additive write inside the trust boundary. Appends a note; cannot edit or delete. The note must not contain text copied from an untrusted source. Laundering an injected instruction into a note that the next agent reads is memory poisoning, and it is blocked.	`requires_approval`
`search_manual` /mcp/manuals	automatic	—	Read only over a fixed, curated manual corpus. Not attacker-influenceable. Treated as trusted content: no customer writes to it.	`automatic`
`search_tickets` /mcp/tickets	automatic	—	Read only, closed world, bounded at 25 records. No customer identifiers leave the host. Result is tainted as untrusted content: it contains customer-submitted free text.	`automatic`
`raise_parts_order` /mcp/parts	requires approval	service supervisor	Commits chargeable spend against a customer account and is not recallable once the supplier accepts. Approval is per call and per argument set. Changing the part number or quantity after approval invalidates it. A denial is terminal for the call. The agent must escalate, not substitute a cheaper part and try again.	`prohibited`
`export_service_records` /mcp/tickets	prohibited	not delegable to the agent	Moves customer records, including site contacts, outside the organisation. This is the exfiltration leg of the lethal trifecta, and the agent has the other two legs by construction. No approval prompt is offered. An approval prompt for an exfiltration tool is a phishing surface: an operator who is asked often enough will eventually click yes. The human path is a separate records-request workflow outside the agent.	`prohibited`

Three rules that make the table hold

Default deny. A tool that is not in the registry is prohibited. A server that adds a tool between two tools/list calls — the rug pull behind CVE-2025-54136, CVSS 8.8 — gains no authority by doing so.
Authority is host-side. The right-hand column shows what the server's own annotations would imply. It is displayed for comparison and it is not consulted: the specification says clients must treat annotations as untrusted unless the server is trusted, and a hint that the server controls cannot be the thing that decides what the server is allowed to do.
Prohibited means no prompt. There is deliberately no approval dialog for export_service_records. An approval prompt on an exfiltration tool is a phishing surface: ask an operator often enough and one of them says yes. The human path for a records request is a separate workflow the agent cannot reach.

Rendered from pipeline/policy.py, the same object the runtime consults. Nothing on this screen is hardcoded; the source is in Demo4/pipeline/.