01 / The difference
Two facts that must stay separate
A cloud operations agent can call a tool exposing list_instances and terminate_instance. A production incident grants it inventory access for cluster C, not termination authority.
Capability is what a tool, API or credential can technically do. Authority is the bounded permission for this principal, task and effect. The authorized set should be no wider than the needed operation and target.
Inventory the tool’s methods and downstream effects, then map each consequential operation to its own grant and policy check. Place enforcement before the cloud API call and test a direct API route as well as the agent wrapper.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision boundary
Put the check where it can stop the effect.
Inventory the tool’s methods and downstream effects, then map each consequential operation to its own grant and policy check. Place enforcement before the cloud API call and test a direct API route as well as the agent wrapper.
03 / Failure and evidence
What goes wrong, and what can be proven?
A tool allowlist or broad service credential is mistaken for action permission, so a legitimate inventory task can terminate a production instance.
Record the tool and method, normalized instance identifier, task grant, decision and actual cloud operation ID. Catalog visibility alone is not decision evidence.
04 / Canonical scope
Why this reference stands alone
Action-level authorization describes how to decide one verb; this comparison establishes why the surrounding tool exposure is insufficient evidence of authority.
Decision analysis
Map capability to the actual effect
A catalog is a map of possible operations. It is not a list of permitted effects. The enforcement inventory must cover each path from tool invocation to the downstream API.
- list_instances
- Read inventory for cluster C; allow only if the task and data scope match.
- terminate_instance
- Irreversible production effect; require separate grant and target check.
- Direct cloud API call
- Same operation; reject if the tool wrapper was the only check.
Negative test
Hide terminate_instance from tool discovery but invoke it by name, then call the cloud API directly with the agent credential. Both should still be denied without termination authority.
Primary references