Pure capability/context gating for the MCP server (BOU-97 threat model).
The question this answers: an agent may be pointed at a live REPL with a production database. What is it allowed to do? Every tool declares a capability tier; the active context grants a ceiling derived from the environment. Authorization is a pure decision here; the shell enforces it and audits the outcome.
See ADR-031 for the threat model and rationale.
Pure capability/context gating for the MCP server (BOU-97 threat model). The question this answers: an agent may be pointed at a live REPL with a production database. What is it allowed to do? Every tool declares a capability tier; the active context grants a ceiling derived from the environment. Authorization is a pure decision here; the shell enforces it and audits the outcome. See ADR-031 for the threat model and rationale.
(authorize context tool)Pure authorization decision for invoking tool under context.
tool is a map with :name and :capability (:read | :generate | :execute).
Returns {:allow? bool :reason str :tool :capability :mode}. Fail-closed: unknown capability or a disabled context denies.
Pure authorization decision for invoking `tool` under `context`.
`tool` is a map with :name and :capability (:read | :generate | :execute).
Returns {:allow? bool :reason str :tool :capability :mode}. Fail-closed:
unknown capability or a disabled context denies.(describe context)A compact, loggable summary of a context (no secrets) for audit events. Boolean flags are always present (defaulted) so the shape is stable.
A compact, loggable summary of a context (no secrets) for audit events. Boolean flags are always present (defaulted) so the shape is stable.
(permit? context tool)Boolean convenience over authorize.
Boolean convenience over `authorize`.
(resolve-context env-map)Pure: derive the active security context from an environment map (String -> String). Precedence — explicit MCP override > CI detection > BND_ENV > fail-closed default (:read-only).
Returns a context map: {:mode :source :env :ci? :allowlist + policy keys}.
:allowlist defaults to :all (see with-allowlist).
Pure: derive the active security context from an environment map
(String -> String). Precedence — explicit MCP override > CI detection >
BND_ENV > fail-closed default (:read-only).
Returns a context map: {:mode :source :env :ci? :allowlist + policy keys}.
`:allowlist` defaults to :all (see `with-allowlist`).(tier-allowed? max-tier capability)Is capability within the max-tier ceiling? Fail-closed: unknown tiers,
or a nil ceiling, deny.
Is `capability` within the `max-tier` ceiling? Fail-closed: unknown tiers, or a nil ceiling, deny.
(with-allowlist context tool-names)Restrict context to an explicit set of tool names. Tools outside the set
are denied even if their tier is within the ceiling.
Restrict `context` to an explicit set of tool names. Tools outside the set are denied even if their tier is within the ceiling.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |