allowed_tools
A capability whitelist mechanism in which a task declares in its data structure the list of tools it may invoke; the list is passed to the agent before execution so that it can act only within that scope, consistent with the principle of least privilege.
Timeline (last 90 days)
Under the default-deny policy, an empty allowed_tools causes any tool call to be rejected, which is a fail-safe design.
The control plane's router logs at task start and decides in order: human-lane or approval-required tasks go to the human queue, workflow-lane tasks execute fixed steps, and otherwise the task goes to the agent with the allowed_tools whitelist passed in.
The allowed_tools mechanism makes the permission boundary independent of model behavior, becoming a statically checkable security property, so even if the model is induced or hallucinates, tool calls not on the list cannot occur.
The allowed_tools configuration option is used to authorize the tools an Agent may use, such as read, edit, and glob.
All Facts (4)
Under the default-deny policy, an empty allowed_tools causes any tool call to be rejected, which is a fail-safe design.
50%UnverifiedThe control plane's router logs at task start and decides in order: human-lane or approval-required tasks go to the human queue, workflow-lane tasks execute fixed steps, and otherwise the task goes to the agent with the allowed_tools whitelist passed in.
50%UnverifiedThe allowed_tools mechanism makes the permission boundary independent of model behavior, becoming a statically checkable security property, so even if the model is induced or hallucinates, tool calls not on the list cannot occur.
50%UnverifiedThe allowed_tools configuration option is used to authorize the tools an Agent may use, such as read, edit, and glob.
50%