How is each agent action authorized?

Before a credential is issued for any tool call, policy checks the resource, the action, the purpose, and the approval state. Rules are declarative and evaluated on every call: deny by default, allow by explicit rule, and a refusal can still override an allow. The check is “may this principal take this action on this object”, never “on objects like this”.

Read access, write access, and human approval are configured separately, so a workflow can read broadly and still require a named person to approve every change it proposes. Context narrows and brokers access; the destination system remains the final enforcement point.