Agent tools
A tool is authority.Govern it like one.
Every tool an agent can call is a capability someone granted, often implicitly, by installing an MCP server or pasting a schema. Trustivan inventories the tools MCP servers list, records each tool's effect with who declared it, holds the entitlements an operator declares and challenges calls to tools whose effect nobody has declared.
AvailableTool inventory, declared effect and entitlements
Tool inventory · support-copilot
6 tools · 2 with no declared effect · 2 not entitled
- tickets.readMCP · mcp://ticketsReadPublisherEntitled
- tickets.replyMCP · mcp://ticketsWritePublisherEntitled
- crm.export_recordsMCP · mcp://crm-toolsWriteOperatorEntitled
- payments.issue_refundMCP · mcp://paymentsAdminOperatorNot entitled
- docs.searchMCP · mcp://docs-searchUnknownNoneEntitled
- shell.execMCP · mcp://build-toolsUnknownNoneNot entitled
Illustrative · sample environment
Illustrative tool inventory for one agent · effect, basis and entitlement
The problem
Nobody granted the tool. It just appeared.
Tool access is the fastest-growing form of machine authority and the least governed, because the act of granting it looks like configuration rather than access.
Tools Arrive Silently
Installing an MCP server or pasting a schema adds capabilities with no ticket, no review and no record of who did it
Scope Lives In A Schema
A tool description says what the tool can do, not what this agent should be allowed to do with it
Impact Is Uneven
A search tool and a refund tool are both tools; only one of them deserves an approval step
How Trustivan approaches it
Inventory. Classify. Entitle. Record.
Tool governance attaches to the agent identity, so it survives a laptop rebuild, a framework upgrade and a change of owner.
Inventory
Every tool an MCP server lists, recorded against its server and marked absent, never deleted, when the server stops listing it.
Classify effect
Each tool's effect is read, write, administrative or unknown, from the publisher's readOnlyHint or an operator's declaration, never from its name or description.
Declare entitlements
An operator declares which agent may call which tool. The declaration is policy attached to the identity rather than configuration on a laptop.
Record the basis
Every effect and entitlement names who declared it, publisher or operator, so a finding says who made a claim instead of asserting it is true.
Effect
Not every tool deserves the same scrutiny
Effect keeps governance proportionate: reads pass with evidence recorded, while mutating calls and tools nobody has described earn scrutiny at the gate.
See the high-impact action use caseRead
Search, fetch, list and summarize. Not gated on entitlement at runtime, with every decision recorded
Write
Reply, update, create and delete. Against a resource an operator classified high impact, it returns CHALLENGE without a grant behind it
Administrative
Grant access, change configuration, create credentials. Returns CHALLENGE unless a live grant covers it, because admin rights are not standing access
Unknown
Nobody has declared what the tool does. A call to it returns CHALLENGE until the publisher or an operator says
What you get
Tool governance you can evidence
Every tool answers where it came from, what it is declared to do, who declared that and which agents may call it.
Tool Inventory
Every tool each MCP server lists, where it came from and when it was first discovered
Entitlements As Policy
The tools an operator declared for an agent, surfaced as findings in the graph and enforced at the gate
Declared Effect
Each tool's effect with its basis, and an operator override that outranks every later sync
High-Impact Tool Findings
Agents entitled to a tool the graph shows reaching a high-impact resource, and agents holding tools with no declared effect
Entitlement Drift
Declared tools an agent was not seen using, and use nothing declared, reported for review through the API
Use Outside Entitlement
An ingested tool invocation by an agent with no entitlement to that tool becomes a finding with the evidence attached
At runtime
From governed tools to authorized tool calls
A governed inventory is the prerequisite for runtime control: you cannot authorize a call to a tool you have not identified, classified and entitled.
Every tool call, decided before it runsAvailable
Trustivan puts each tool call an agent runtime submits through the same evaluation as any other action: the principal resolved from the presented credential, the tool an operator entitled to it, the effect of the call and the impact of the resource. Reads are not gated on entitlement, and most calls are allowed with the decision recorded. A mutating call against a high-impact resource returns CHALLENGE until a grant stands behind it.
- Entitlements enforced at the call, not only reported as findings.
- A mutating call to a tool this agent is not entitled to returns DENY once its entitlements are declared, and CHALLENGE while none are.
Agent action decisions
Runtime authorization · available
- release-agent · create deploymentALLOWnow
- triage-agent · change branch protectionCHALLENGE2m
- cleanup-bot · delete bucketCHALLENGE6m
- research-agent · call a tool it is not entitled toDENY11m
- ci-runner · read secretALLOW14m
Illustrative · agents are not discovered; tool entitlements are declared by an operator
Illustrative actions · agents are not discovered; tool entitlements are declared by an operator