01 / Principal and identity
Who acts, and what can the platform identify?
A graph run and any subordinate agent act under an originating task.
Graph state can carry task context; the tool needs a verified principal and grant, not merely mutable state.
- 01Originating task
- 02Agent or workload
- 03A ToolNode dispatches a production restart tool.
- 04Observed effect
02 / Action-time control
Where can an unauthorized effect be stopped?
Check immediately before the tool executes and keep the production API protected.
Constrain environment, instance, maintenance window and restart count.
Delegation constraint
A subgraph inherits only a narrowed task grant, not every tool available to the parent graph.
03 / Worked denial
Test a request outside the grant.
A diagnostic run reaches a restart node after a model proposes a repair.
Adversarial verification
Route a diagnostic graph state to the restart ToolNode. The tool wrapper must deny the production restart even when a conditional edge reaches that node successfully.
04 / Review and responsibility
What should the audit trail prove?
Run and node IDs, grant lineage, tool arguments, decision, API result and server health.
Conditional graph edges coordinate workflow; they do not replace authorization at the executor.
Platform primary source