FIN-CLIENT-002
Client B document reads require an explicit enforce grant.
Active
Policies & grants
Authoritative policy metadata exported to Agentgateway CEL rules. Grants control enforce-mode tool access.
Policies
| Code | Version | Description | Status | Effective | |
|---|---|---|---|---|---|
| FIN-CLIENT-002 | 1 | Client B document reads require an explicit enforce grant. | Active | 2026-11-01 02:00 UTC | |
| FIN-READ-001 | 1 | Authenticated agent and human required for ERP read tools. | Active | 2026-11-01 02:00 UTC | |
| FIN-WRITE-007 | 1 | Financial writes run only after a human approves each call. | Active Approval | 2026-11-01 02:00 UTC |
FIN-READ-001
Authenticated agent and human required for ERP read tools.
Active
FIN-WRITE-007
Financial writes run only after a human approves each call.
Active Approval
Agent tool grants
| Agent | Tool | Mode | Notes | |
|---|---|---|---|---|
| Invoice Agent | get_invoice_tool | Enforce | Invoice reads for the fictional finance employee | |
| Invoice Agent | list_documents_client_a | Enforce | Authorized client A | |
| Invoice Agent | list_documents_client_b | Observe | Client B access is not granted | |
| Invoice Agent | update_invoice_tool | Observe | Writes are observed, not granted | |
| Payables Agent | get_invoice_tool | Enforce | Reads the invoice before correcting it | |
| Payables Agent | update_invoice_tool | Enforce | Invoice corrections, each approved by a controller |
Invoice Agent
get_invoice_tool
Enforce
Invoice Agent
list_documents_client_a
Enforce
Invoice Agent
list_documents_client_b
Observe
Invoice Agent
update_invoice_tool
Observe
Payables Agent
get_invoice_tool
Enforce
Payables Agent
update_invoice_tool
Enforce