01 / The operating case
What changes in a real workflow?
A help-desk agent may call update_customer, but only for the account named in its active ticket.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Allowlist the tool as a coarse boundary, then authorize the normalized account, operation and task on every consequential invocation.
03 / Failure and evidence
What goes wrong, and what can be proven?
One allowlisted write tool becomes a path to every customer account.
Record catalog version, selected tool, target-specific decision and executor result.
04 / Canonical scope
Why this reference stands alone
Discovery versus authority explains the conceptual difference; this page owns allowlist deployment and its bypass tests.
Protocol or attack trace
Allowlist boundary
Tool update_customer is allowed globally; agent task names only account A, but call arguments name account B.
Allowlisted tool with B must still be denied by per-target authorization.
Primary references