AI Agent Orchestration Platform  ·  View 09 of 32  ·  2 · Structure

Tool Plane and Permissions

How each class of tool is discovered, authorised, invoked, validated and recorded.

Editable source SVG draw.io All views
Discover Authorise Invoke Validate Record HTTP and REST API Center entry Agent scope grant APIM egress JSON Schema Tool call span MCP servers MCP tools/list Server allow-list MCP over HTTP Result schema Tool call span Data and search Index catalogue Row-level filter AI Search query Citation binding Provenance record Code and browser Session template Egress policy Dynamic session Output size cap Artifact to ADLS Sensitive actions Marked in registry Human approval Idempotency key Effect assertion Audit ledger Tool Plane — Discovery, Authorisation and Invocation by Tool Class Application we own Security / platform Interface / broker Data store Decision point Every lane ends in a record. A tool the registry does not list cannot be called, whatever the model asks for. v 1.0 · owner Integration Architecture · date 2026-08

Decisions

  • Tools are out-of-process and least-privileged; the runtime holds no long-lived tool credential
  • A tool the registry does not list cannot be invoked, whatever the model emits
  • Sensitive tools are marked in the registry and their approval requirement is a property of the tool, not of the prompt

Contract requirements

  • Strong input and output schemas, a version, a health check and a declared timeout for every tool
  • Idempotency key on every mutating call, derived from execution id, step id and the argument hash
  • Per-agent and per-tenant rate limits, enforced at the gateway rather than in the tool

Risks

  • MCP servers are a young ecosystem; partner servers are treated as untrusted and run behind the gateway with no network path to internal data
  • Idempotency depends on the downstream system honouring the key; where it does not, a compensation step is mandatory
  • Browser and computer-use tools carry the widest blast radius and are default-denied at organisation scope
◀  Model Abstraction and Routing All views Event and Messaging Topology  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-08 · 32 views · Microsoft Azure09-tool-plane-and-permissions