Source: Agent Tool Governance and Authorization Stack

Sources: MCP tools, Arcade authorized tool calling, Composio MCP guide, OpenFGA concepts, OPA docs, Cedar docs, E2B docs

What It Covers

This source distills the governance layer needed when AI agents can call tools that touch enterprise systems.

MCP tools expose model-controlled callable capabilities with names, descriptions, input schemas, optional output schemas, annotations, and structured results.
MCP docs recommend user confirmation for sensitive operations and clear UI around which tools are exposed.
Arcade provides OAuth/API-key/user-token handling for tool calls, with user approval URLs and token reuse per user.
Composio positions MCP Tool Router and MCP Gateway patterns as ways to centralize tool discovery, auth, observability, RBAC, rate limiting, and governance across many integrations.
OpenFGA provides relationship-based access control using relationship tuples and authorization models.
Open Policy Agent decouples policy decisions from application code through Rego policies over structured input.
Cedar is a policy language with permit/forbid effects, default deny, forbid-overrides-permit, and schema validation.
E2B provides isolated sandboxes for agents to run code, commands, files, and git operations without direct access to production infrastructure.

Init Intelligence needs an agent tool gateway, not just an MCP client. The gateway should own:
- tool discovery,
- per-tenant schemas,
- credential storage,
- user/service authorization,
- policy checks,
- approval gates,
- execution traces,
- rate limits,
- sandboxing for generated code.
MCP is necessary but insufficient: base tool schemas do not solve enterprise auth, token lifecycle, least privilege, audit, or policy.
For ITSM, every tool call should answer: who requested it, who approved it, which policy allowed it, which credential was used, what changed, and how to undo or remediate. ^[inferred]

Arcade and Composio reduce integration/auth work but introduce platform dependency and must be evaluated for enterprise deployment, data residency, and control-plane risk.
OPA, Cedar, and OpenFGA solve related but different problems; choosing one too early may lock the product into a policy model before buyer requirements are known.