# ToolApprovalRuleStoreContract
> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.testing.contracts.storage.toolapprovalrulestorecontract/
> Summary: ToolApprovalRuleStoreContract: Behavior tests for the IToolApprovalRuleStore contract.
Behavior tests for the [IToolApprovalRuleStore](/api/tracon.itoolapprovalrulestore/) contract.
```csharp
public abstract class ToolApprovalRuleStoreContract : TenantIsolationContract, IAsyncLifetime, IAsyncDisposable
```
## Remarks
A persisted approval rule is a **security
record**: one tenant's rule must never let another tenant's tool
call through without approval.
## Constructors
### ToolApprovalRuleStoreContract\(\)
```csharp
protected ToolApprovalRuleStoreContract()
```
## Methods
### A\_list\_value\_that\_differs\_only\_in\_whitespace\_is\_the\_same\_condition\_set\(\)
A list value written with different whitespace is the same condition, so
the rule is not stored twice.
```csharp
[Fact]
public Task A_list_value_that_differs_only_in_whitespace_is_the_same_condition_set()
```
#### Returns
[Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task)
### A\_path\_carrying\_separator\_characters\_does\_not\_merge\_two\_condition\_sets\(\)
Two different condition sets stay two rules even when a path carries the
characters a store might use to join the fields it compares.
```csharp
[Fact]
public Task A_path_carrying_separator_characters_does_not_merge_two_condition_sets()
```
#### Returns
[Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task)
#### Remarks
A path is free text - a JSON property name may hold any character. A
store that deduplicates on a joined text of path, operator, and value
must not let one set's path read as another set's field boundary.
Otherwise the second rule is merged into the first: the store keeps the
first rule and hands it back as if the second had been saved.
### Added\_rule\_is\_read\_back\(\)
```csharp
[Fact]
public Task Added_rule_is_read_back()
```
#### Returns
[Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task)
### Argument\_conditions\_round\_trip\(\)
```csharp
[Fact]
public Task Argument_conditions_round_trip()
```
#### Returns
[Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task)
### Condition\_scoped\_rule\_added\_twice\_leaves\_a\_single\_record\(\)
```csharp
[Fact]
public Task Condition_scoped_rule_added_twice_leaves_a_single_record()
```
#### Returns
[Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task)
### CountAsync\(string, CancellationToken\)
Reports how many records the given tenant sees through the listing endpoint.
```csharp
protected override ValueTask CountAsync(string tenantId, CancellationToken cancellationToken)
```
#### Parameters
`tenantId` [string](https://learn.microsoft.com/dotnet/api/system.string)
The reading tenant.
`cancellationToken` [CancellationToken](https://learn.microsoft.com/dotnet/api/system.threading.cancellationtoken)
The token every store call inside the hook must be handed; see
[TenantIsolationContract.SeedAsync](/api/tracon.testing.contracts.storage/).
#### Returns
[ValueTask](https://learn.microsoft.com/dotnet/api/system.threading.tasks.valuetask\-1)<[int](https://learn.microsoft.com/dotnet/api/system.int32)\>
The number of records seen.
### Deleting\_a\_nonexistent\_rule\_returns\_false\(\)
```csharp
[Fact]
public Task Deleting_a_nonexistent_rule_returns_false()
```
#### Returns
[Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task)
### Different\_agent\_becomes\_a\_separate\_rule\(\)
```csharp
[Fact]
public Task Different_agent_becomes_a_separate_rule()
```
#### Returns
[Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task)
### Different\_conditions\_become\_a\_separate\_rule\(\)
```csharp
[Fact]
public Task Different_conditions_become_a_separate_rule()
```
#### Returns
[Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task)
### Different\_source\_fingerprint\_becomes\_a\_separate\_rule\(\)
Two rules that differ only in their source fingerprint are two rules.
```csharp
[Fact]
public Task Different_source_fingerprint_becomes_a_separate_rule()
```
#### Returns
[Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task)
#### Remarks
A server that moved to another endpoint keeps its tool names. If the
fingerprint were not part of the identity, a rule for the new endpoint
would come back as the old rule, which names the old endpoint and never
approves the new one.
### ExistsAsync\(string, object\)
Reports whether the record is visible from the given tenant's viewpoint.
```csharp
protected override ValueTask ExistsAsync(string tenantId, object key)
```
#### Parameters
`tenantId` [string](https://learn.microsoft.com/dotnet/api/system.string)
The reading tenant.
`key` [object](https://learn.microsoft.com/dotnet/api/system.object)
The key returned by [TenantIsolationContract.SeedAsync](/api/tracon.testing.contracts.storage/).
#### Returns
[ValueTask](https://learn.microsoft.com/dotnet/api/system.threading.tasks.valuetask\-1)<[bool](https://learn.microsoft.com/dotnet/api/system.boolean)\>
[true](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool) if the record is visible.
### Same\_scope\_added\_twice\_leaves\_a\_single\_record\(\)
```csharp
[Fact]
public Task Same_scope_added_twice_leaves_a_single_record()
```
#### Returns
[Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task)
### SeedAsync\(string, string, CancellationToken\)
Writes a sample record for the given tenant.
```csharp
protected override ValueTask