Agent Control Tower ACT
Sandbox · fictional data

Sandbox

Open another client's documents

The same agent asks for client B's documents, which no grant covers. The gateway hides the tool and refuses the call.

Denied Started 2026-11-01 02:00:54 UTC · took 0.6 s

Denied: the tool was hidden and the call refused; nothing was returned.

invoice-agent for employee-demo-42 · run sbx-denied-client-51b3f005a9

What happened

  1. invoice-agent signed in for employee-demo-42

    The demo issuer signed a short-lived token naming the agent, the employee, and this run; the gateway checks it on every call.

  2. Tools the gateway lets it see

    get_invoice_tool, list_documents_client_a

  3. Asked for client B's documents

    Refused by the gateway: no grant gives this agent the tool.

  4. Gateway decision recorded: denied

    ACT-DEFAULT-DENY v1 · revision 595f4c6d39ef · chained as event 1

Open the run timeline Run another scenario