01 / The operating case
What changes in a real workflow?
An agent may inspect firewall rules but is asked to apply a new rule during an incident.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Classify actual downstream effects, require a narrower grant and current incident context for apply, then verify the firewall state.
03 / Failure and evidence
What goes wrong, and what can be proven?
A single “firewall tool” permission authorizes both inspection and production changes.
Record effective verb, target, applied rule, decision and observed enforcement state.
04 / Canonical scope
Why this reference stands alone
Action-level authorization defines the generic principle; this page gives an MCP tool taxonomy and effect test.
Protocol or attack trace
Effect-classification check
Firewall tool exposes inspect_rules and apply_rules behind one server token.
Read grant allows inspect but apply to production rule ID must require separate write grant and approval.
Primary references