Tool permissions
Also known as: tool authorization
Tool permissions are the per-tool rules controlling what an agent may call and with which arguments.
- Some tools always allowed, some gated, some forbidden.
- Argument-level checks (e.g. only these domains).
- The fine-grained layer beneath the general permission model.
Granularity matters: the difference between "can use the send-email tool" and "can send email only to these addresses" is the difference between a capability and a control.