Every tool call is mediated by the policy decision point (PDP). The PDP is small, deterministic, and audited. Its rulings are the gating contract between intent and effect.
Every tool call — from a human operator, an integration, or an agent — is mediated by the
policy decision point (PDP). The PDP is small, deterministic, and audited. Its rulings are
the gating contract between intent and effect.
Every PDP ruling, allow or deny, is recorded as a typed AuditEvent: policy.allow or policy.deny. The record includes the request shape, the matched rule path, and the input version of the tenant policy. PDP rulings are immutable; subsequent rulings on the same input are independent records.
An agent definition declares its required scopes. The platform enforces the minimum: a scope not declared cannot be used at runtime, even if the principal calling the agent holds it. This prevents privilege amplification through agent invocation.
The effective permission set at any instant equals the minimum of:
caller-principal grant, agent declared scopes, subject marking clearance, ABAC
predicate satisfaction. Privilege never increases by traversing planes.
Tenant access policies are versioned data, not code. The PDP reads the active version; changes are typed AuditEvents (policy.update) on the tenant chain. Rollback is a re-promotion of a prior version.
The PDP is in-substrate and synchronous. Cache keys are (principal-version, subject-marking-set, tool-id, tool-version, policy-version); cache invalidation is triggered by any of the inputs changing. The PDP target SLO is p99 ≤ 5ms.
If the PDP cannot reach its policy store or its principal store, it fails closed. Tools cannot dispatch; reasoning runs cannot start; commits cannot complete. This is non-configurable.
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Layerup","colors":{"primary":"#0a0a0b","light":"#3d3d3f","dark":"#0a0a0b"},"logo":{"light":"https://mintcdn.com/layerup/7JDjwgQFFUauG8YE/logo/logo-lightmode.png?fit=max\u0026auto=format\u0026n=7JDjwgQFFUauG8YE\u0026q=85\u0026s=e3cb87895efb1a8ca2d812d71d4afe32","dark":"https://mintcdn.com/layerup/7JDjwgQFFUauG8YE/logo/logo-darkmode.png?fit=max\u0026auto=format\u0026n=7JDjwgQFFUauG8YE\u0026q=85\u0026s=b3966afbf43531ec235964cfa3bb865a"},"favicon":"https://mintcdn.com/layerup/7JDjwgQFFUauG8YE/favicon.png?fit=max\u0026auto=format\u0026n=7JDjwgQFFUauG8YE\u0026q=85\u0026s=6a7afccf7183fa330023e2abfab54e21","appearance":{"default":"light"},"background":{"color":{"light":"#ffffff","dark":"#0a0a0b"}},"navbar":{"primary":{"type":"button","label":"Request Access","href":"https://www.uselayerup.com/contact"}},"footer":{"socials":{"twitter":"https://twitter.com/layerup_","github":"https://github.com/layerupai","linkedin":"https://www.linkedin.com/company/layerupai"}},"styling":{"latex":true},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"layerup","hasAudioNarration":false,"actualSubdomain":"layerup","customDomains":["docs.uselayerup.com"],"gitSource":{"type":"github","owner":"layerupai","repo":"core","deployBranch":"main","contentDirectory":"docs/layerup-docs","isPrivate":true,"mountPath":"","label":""},"entitlements":{},"buildId":"6aebed8a7322b8787c5c1697","clientVersion":"0.0.4094","searchFilterCounts":[{"language":"default","tag":"Platform Docs","count":23},{"language":"default","tag":"Agents Docs","count":21},{"language":"default","tag":"Deployment Architecture","count":7},{"language":"default","tag":"Foundations","count":6},{"language":"default","tag":"Security \u0026 Governance","count":6},{"language":"default","tag":"Operations","count":4},{"language":"default","tag":"Configuration \u0026 Lifecycle","count":3},{"language":"default","tag":"Logic \u0026 Reasoning","count":3},{"language":"default","tag":"Data \u0026 Integration","count":2},{"language":"default","tag":"Observability \u0026 Resilience","count":2}]},"assistantConfig":{},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"comment-mode","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"security/tool-governance","slug":"/security/tool-governance","pageMetadata":{"title":"Tool Invocation Governance","description":"Every tool call is mediated by the policy decision point (PDP). The PDP is small, deterministic, and audited. Its rulings are the gating contract between intent and effect.","href":"/security/tool-governance"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Every tool call is mediated by the policy decision point (PDP). The PDP is small, deterministic, and audited. Its rulings are the gating contract between intent and effect.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={code:`code`,em:`em`,p:`p`,pre:`pre`,span:`span`,tbody:`tbody`,td:`td`,th:`th`,thead:`thead`,tr:`tr`,..._provideComponents(),...props.components},{CodeBlock,Heading,Table,Warning}=_components;if(!CodeBlock)_missingMdxReference(`CodeBlock`,true);if(!Heading)_missingMdxReference(`Heading`,true);if(!Table)_missingMdxReference(`Table`,true);if(!Warning)_missingMdxReference(`Warning`,true);return _jsxs(_Fragment,{children:[_jsx(Heading,{level:`1`,id:`16-—-tool-invocation-governance`,children:`16 — Tool invocation governance.`}),`\n`,_jsx(_components.p,{children:`Every tool call — from a human operator, an integration, or an agent — is mediated by the\npolicy decision point (PDP). The PDP is small, deterministic, and audited. Its rulings are\nthe gating contract between intent and effect.`}),`\n`,_jsx(Heading,{level:`2`,id:`16-1-pdp-request-shape`,children:`16.1 PDP request shape`}),`\n`,_jsx(CodeBlock,{filename:``,numberOfLines:`6`,language:`json`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`json`,children:_jsxs(_components.code,{language:`json`,numberOfLines:`6`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`{`})}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:` \"principal\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: { `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"id\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"…\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`, `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"kind\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"agent|human|service\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`, `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"scopes\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: [ `}),_jsx(_components.span,{style:{color:`#82071E`,\"--shiki-light-font-style\":`italic`,\"--shiki-dark\":`#F44747`,\"--shiki-dark-font-style\":`inherit`},children:`…`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:` ], `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"clearances\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: [ `}),_jsx(_components.span,{style:{color:`#82071E`,\"--shiki-light-font-style\":`italic`,\"--shiki-dark\":`#F44747`,\"--shiki-dark-font-style\":`inherit`},children:`…`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:` ], `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"region\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"eu-central-1\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:` },`})]}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:` \"tool\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: { `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"id\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"tool.\u003cname>\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`, `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"version\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"2.4.1\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`, `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"effectClass\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"stage|commit-low|…\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`, `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"requiredScopes\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: [ `}),_jsx(_components.span,{style:{color:`#82071E`,\"--shiki-light-font-style\":`italic`,\"--shiki-dark\":`#F44747`,\"--shiki-dark-font-style\":`inherit`},children:`…`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:` ], `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"purpose\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"claims.adjustment\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:` },`})]}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:` \"subject\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: { `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"ref\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"claim_…\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`, `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"marking\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: [ `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"pii.medium\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:` ], `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"regionPin\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"eu-central-1\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:` },`})]}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:` \"environment\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: { `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"now\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"2026-05-28T17:21:00Z\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`, `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#9CDCFE`},children:`\"tenantPolicyVersion\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`\"2026.05\"`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:` }`})]}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`}`})}),`\n`]})})}),`\n`,_jsx(Heading,{level:`2`,id:`16-2-pdp-algorithm`,children:`16.2 PDP algorithm`}),`\n`,_jsx(_components.p,{children:`The PDP runs a fixed sequence. The first failing step terminates with a typed deny.`}),`\n`,_jsx(CodeBlock,{filename:``,numberOfLines:`39`,language:`text`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`text`,children:_jsxs(_components.code,{language:`text`,numberOfLines:`39`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`1. STRUCTURAL`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: tool registered \u0026 enabled`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: tool version not deprecated`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` else → deny(reason=structural)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`2. SCOPE INTERSECTION`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: principal.scopes ⊇ tool.requiredScopes`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: principal.scopes ⊇ subject.requiredReadScopes`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` else → deny(reason=scope)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`3. MARKING CLEARANCE`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` for each marking in subject.marking:`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: principal.clearances.allows(marking)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` else → deny(reason=marking)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`4. PURPOSE COMPATIBILITY`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: tool.purpose ∈ marking.allowedPurposes (∀ marking in subject)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: tool.purpose ∉ marking.disallowedPurposes`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` else → deny(reason=purpose)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`5. REGION`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: principal.region == subject.regionPin`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: tool.endpoint.region == subject.regionPin`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` else → deny(reason=region)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`6. ABAC PREDICATES`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: every tenant predicate evaluates true`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` else → deny(reason=abac)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`7. AUTHORITY (effect-bearing tools only)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: principal.authority covers (subject, payload)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` else → deny(reason=authority)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`8. RATE / BUDGET`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` require: principal-and-tool budget not exceeded`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` else → deny(reason=budget)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`9. ALLOW`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})})]})})}),`\n`,_jsx(Heading,{level:`2`,id:`16-3-rejection-taxonomy`,children:`16.3 Rejection taxonomy`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Reason`}),_jsx(_components.th,{children:`Class`}),_jsx(_components.th,{children:`Operator visibility`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`structural`})}),_jsx(_components.td,{children:`configuration`}),_jsx(_components.td,{children:`operator alert`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`scope`})}),_jsx(_components.td,{children:`permission`}),_jsx(_components.td,{children:`operator alert · principal notified`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`marking`})}),_jsx(_components.td,{children:`permission`}),_jsx(_components.td,{children:`operator alert · security notified`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`purpose`})}),_jsx(_components.td,{children:`permission`}),_jsx(_components.td,{children:`operator alert · security notified`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`region`})}),_jsx(_components.td,{children:`compliance`}),_jsx(_components.td,{children:`operator alert · security notified`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`abac`})}),_jsx(_components.td,{children:`permission`}),_jsx(_components.td,{children:`operator alert`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`authority`})}),_jsx(_components.td,{children:`policy`}),_jsx(_components.td,{children:`operator alert · authority chain`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`budget`})}),_jsx(_components.td,{children:`operations`}),_jsx(_components.td,{children:`operator alert · cost dashboard`})]})]})]}),`\n`,_jsx(Heading,{level:`2`,id:`16-4-dispatch-time-audit`,children:`16.4 Dispatch-time audit`}),`\n`,_jsxs(_components.p,{children:[`Every PDP ruling, allow or deny, is recorded as a typed AuditEvent: `,_jsx(_components.code,{children:`policy.allow`}),` or `,_jsx(_components.code,{children:`policy.deny`}),`. The record includes the request shape, the matched rule path, and the input version of the tenant policy. PDP rulings are immutable; subsequent rulings on the same input are independent records.`]}),`\n`,_jsx(Heading,{level:`2`,id:`16-5-agent-scope-minimisation`,children:`16.5 Agent scope minimisation`}),`\n`,_jsx(_components.p,{children:`An agent definition declares its required scopes. The platform enforces the minimum: a scope not declared cannot be used at runtime, even if the principal calling the agent holds it. This prevents privilege amplification through agent invocation.`}),`\n`,_jsx(Warning,{children:_jsx(_components.p,{children:`The effective permission set at any instant equals the minimum of:\ncaller-principal grant, agent declared scopes, subject marking clearance, ABAC\npredicate satisfaction. Privilege never increases by traversing planes.`})}),`\n`,_jsx(Heading,{level:`2`,id:`16-6-policy-as-data`,children:`16.6 Policy as data`}),`\n`,_jsxs(_components.p,{children:[`Tenant access policies are versioned data, not code. The PDP reads the active version; changes are typed AuditEvents (`,_jsx(_components.code,{children:`policy.update`}),`) on the tenant chain. Rollback is a re-promotion of a prior version.`]}),`\n`,_jsx(Heading,{level:`2`,id:`16-7-latency-\u0026-caching`,children:`16.7 Latency \u0026 caching`}),`\n`,_jsxs(_components.p,{children:[`The PDP is in-substrate and synchronous. Cache keys are `,_jsx(_components.em,{children:`(principal-version, subject-marking-set, tool-id, tool-version, policy-version)`}),`; cache invalidation is triggered by any of the inputs changing. The PDP target SLO is p99 ≤ 5ms.`]}),`\n`,_jsx(Heading,{level:`2`,id:`16-8-failure-open-prohibition`,children:`16.8 Failure-open prohibition`}),`\n`,_jsx(_components.p,{children:`If the PDP cannot reach its policy store or its principal store, it fails closed. Tools cannot dispatch; reasoning runs cannot start; commits cannot complete. This is non-configurable.`})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Tool Invocation Governance","description":"Every tool call is mediated by the policy decision point (PDP). The PDP is small, deterministic, and audited. Its rulings are the gating contract between intent and effect.","href":"/security/tool-governance"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[{"title":"16 — Tool invocation governance.","slug":"16-—-tool-invocation-governance","depth":1,"children":[]},{"title":"16.1 PDP request shape","slug":"16-1-pdp-request-shape","depth":2,"children":[]},{"title":"16.2 PDP algorithm","slug":"16-2-pdp-algorithm","depth":2,"children":[]},{"title":"16.3 Rejection taxonomy","slug":"16-3-rejection-taxonomy","depth":2,"children":[]},{"title":"16.4 Dispatch-time audit","slug":"16-4-dispatch-time-audit","depth":2,"children":[]},{"title":"16.5 Agent scope minimisation","slug":"16-5-agent-scope-minimisation","depth":2,"children":[]},{"title":"16.6 Policy as data","slug":"16-6-policy-as-data","depth":2,"children":[]},{"title":"16.7 Latency \u0026 caching","slug":"16-7-latency-\u0026-caching","depth":2,"children":[]},{"title":"16.8 Failure-open prohibition","slug":"16-8-failure-open-prohibition","depth":2,"children":[]}],"codeExamples":{}},"jsLinks":[],"subdomain":"layerup","siteName":"Layerup","title":"Tool Invocation Governance - Layerup","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-08-18T22:33:45.955Z","originalFileLocation":"security/tool-governance.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"light\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Every tool call is mediated by the policy decision point (PDP). The PDP is small, deterministic, and audited. Its rulings are the gating contract between intent and effect.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Layerup\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/layerup/AI2c3611NSqy-PIO/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/layerup/AI2c3611NSqy-PIO/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/layerup/AI2c3611NSqy-PIO/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/layerup/AI2c3611NSqy-PIO/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/layerup/AI2c3611NSqy-PIO/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/layerup/AI2c3611NSqy-PIO/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/layerup/AI2c3611NSqy-PIO/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/layerup/AI2c3611NSqy-PIO/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/layerup/AI2c3611NSqy-PIO/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Tool Invocation Governance - Layerup\">\u003cmeta data-mint-head property=\"og:description\" content=\"Every tool call is mediated by the policy decision point (PDP). The PDP is small, deterministic, and audited. Its rulings are the gating contract between intent and effect.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Layerup\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.uselayerup.com/security/tool-governance\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://layerup.mintlify.site/_mintlify/api/og/v2?division=Security+%26+Governance\u0026amp;title=Tool+Invocation+Governance\u0026amp;description=Every+tool+call+is+mediated+by+the+policy+decision+point+%28PDP%29.+The+PDP+is+small%2C+deterministic%2C+and+audited.+Its+rulings+are+the+gating+contract+between+intent\u0026amp;theme=fe521d5d54be411e2d617723\u0026amp;signature=51cb5e7f345996ca22ea41db46a22b0bb157d244147785009f2740b85e5b7085\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Tool Invocation Governance - Layerup\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Every tool call is mediated by the policy decision point (PDP). The PDP is small, deterministic, and audited. Its rulings are the gating contract between intent and effect.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://layerup.mintlify.site/_mintlify/api/og/v2?division=Security+%26+Governance\u0026amp;title=Tool+Invocation+Governance\u0026amp;description=Every+tool+call+is+mediated+by+the+policy+decision+point+%28PDP%29.+The+PDP+is+small%2C+deterministic%2C+and+audited.+Its+rulings+are+the+gating+contract+between+intent\u0026amp;theme=fe521d5d54be411e2d617723\u0026amp;signature=51cb5e7f345996ca22ea41db46a22b0bb157d244147785009f2740b85e5b7085\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/layerup/AI2c3611NSqy-PIO/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Layerup\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#0a0a0b\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.uselayerup.com/security/tool-governance\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/security/tool-governance.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.uselayerup.com/#organization\",\"name\":\"Layerup\",\"url\":\"https://docs.uselayerup.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/layerup/7JDjwgQFFUauG8YE/logo/logo-lightmode.png?fit=max\u0026auto=format\u0026n=7JDjwgQFFUauG8YE\u0026q=85\u0026s=e3cb87895efb1a8ca2d812d71d4afe32\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.uselayerup.com#website\",\"name\":\"Layerup\",\"url\":\"https://docs.uselayerup.com\",\"publisher\":{\"@id\":\"https://docs.uselayerup.com/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.uselayerup.com/security/tool-governance#webpage\",\"url\":\"https://docs.uselayerup.com/security/tool-governance\",\"name\":\"Tool Invocation Governance\",\"description\":\"Every tool call is mediated by the policy decision point (PDP). The PDP is small, deterministic, and audited. Its rulings are the gating contract between intent and effect.\",\"dateModified\":\"2026-08-18T22:33:45.955Z\",\"isPartOf\":{\"@id\":\"https://docs.uselayerup.com#website\"},\"breadcrumb\":{\"@id\":\"https://docs.uselayerup.com/security/tool-governance#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.uselayerup.com/security/tool-governance#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Security \u0026 Governance\",\"item\":\"https://docs.uselayerup.com/security/identity\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Tool Invocation Governance\",\"item\":\"https://docs.uselayerup.com/security/tool-governance\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://docs.uselayerup.com/security/tool-governance#article\",\"headline\":\"Tool Invocation Governance\",\"name\":\"Tool Invocation Governance\",\"description\":\"Every tool call is mediated by the policy decision point (PDP). The PDP is small, deterministic, and audited. Its rulings are the gating contract between intent and effect.\",\"url\":\"https://docs.uselayerup.com/security/tool-governance\",\"mainEntityOfPage\":{\"@id\":\"https://docs.uselayerup.com/security/tool-governance#webpage\"},\"dateModified\":\"2026-08-18T22:33:45.955Z\",\"publisher\":{\"@id\":\"https://docs.uselayerup.com/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.uselayerup.com#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Layerup\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Layerup","nav":{"global":null,"tabs":[{"tab":"Platform Docs","groups":[{"group":"Foundations","pages":[{"title":"Platform Overview","href":"/overview"},{"title":"Architectural Principles","href":"/principles"},{"title":"Platform Topology","href":"/topology"},{"title":"Core Concepts \u0026 Vocabulary","href":"/concepts"}]},{"group":"Ontology","pages":[{"title":"The Insurance Ontology","href":"/ontology/objects"},{"title":"Ontology Evolution, Branching \u0026 Versioning","href":"/ontology/evolution"}]},{"group":"Data Plane","pages":[{"title":"Data Plane — Ingestion","href":"/data/ingestion"},{"title":"Data Abstraction, Mapping, Lineage \u0026 Replay","href":"/data/lineage"}]},{"group":"Logic \u0026 Reasoning","pages":[{"title":"Tool Pattern Library","href":"/tool-patterns"},{"title":"Agent Runtime Architecture","href":"/runtime/runtime"},{"title":"Planner, Executor, Verifier \u0026 Memory","href":"/runtime/internals"}]},{"group":"Models","pages":[{"title":"Model Gateway","href":"/models/gateway"},{"title":"Evaluation, Benchmarks \u0026 Drift","href":"/models/evaluation"}]},{"group":"Action Plane","pages":[{"title":"Action Plane","href":"/action-plane"}]},{"group":"Security \u0026 Governance","pages":[{"title":"Identity, Access \u0026 Safety","description":"Compliance \u0026 Control Layer: identity, RBAC/ABAC, markings, purpose-tagged access, break-glass, encryption, and the Kill Switch that lets operators stop any AI work at any granularity in seconds.","href":"/security/identity"},{"title":"Tool Invocation Governance","href":"/security/tool-governance"},{"title":"Audit, Decision Lineage \u0026 Action Lineage","description":"Tamper-evident by construction: every governance-relevant event is appended to a hash-chained log per tenant. Decision and Action lineage are graph projections over the audit chain.","href":"/security/audit"}]},{"group":"Operations","pages":[{"title":"Observability \u0026 Telemetry","href":"/operations/observability"},{"title":"Deployment Topology \u0026 Tenancy","href":"/operations/deployment"},{"title":"Reliability, Throughput \u0026 SLOs","href":"/operations/reliability"},{"title":"Versioning, Release Gates \u0026 Failure Modes","href":"/operations/release-gates"}]},{"group":"Enterprise","pages":[{"title":"Enterprise Scale \u0026 Federation","href":"/enterprise-scale"},{"title":"Reference Appendix","href":"/appendix"}]}]},{"tab":"Agents Docs","pages":[{"title":"Agents Docs","href":"/agents/overview"}]},{"tab":"Integration Docs","pages":[{"title":"Integration Docs","href":"/integrations/chat-widget/embed"}]},{"tab":"Prompting Guides","hidden":true,"pages":[{"title":"Prompting Guides","href":"/guides/prompting/contents"}]},{"tab":"Usage Guides","hidden":true,"pages":[{"title":"Usage Guides","href":"/guides/usage/customer-support"}]}]},"basePath":"","title":"Tool Invocation Governance - Layerup","buildId":"dpl_42LwxxU1kGN114H4XzwGYXa9ZDah","deploymentId":"dpl_42LwxxU1kGN114H4XzwGYXa9ZDah","dynamics":[],"chunks":[]}
