.NET API
ToolApprovalRule
Tracon.Abstractions.dllA persistent approval rule for a tool call the user said “do not ask again” for.
public sealed record ToolApprovalRule : IEquatable<ToolApprovalRule>- Inheritance
- object ← ToolApprovalRule
- Implements
- IEquatable<ToolApprovalRule>
- Inherited Members
- object.GetType(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()
Remarks
Section titled “Remarks”A rule is bound to the triple tenant + agent + tool. An approval given by one tenant does not hold in another tenant; this is a security boundary and is not relaxed.
When ArgumentsHash is populated the rule covers only a call made with
the same arguments. When it is empty the rule covers every call of the tool.
The distinction exists because Microsoft Agent Framework offers two separate “always
approve” forms: CreateAlwaysApproveToolResponse and
CreateAlwaysApproveToolWithArgumentsResponse.
ToolApprovalRule.ArgumentConditions is a third, admin-authored form: instead of an exact
argument fingerprint it carries a set of comparisons (for example “amount <= 100”)
evaluated on every call. It is mutually exclusive with ArgumentsHash.
Constructors
Section titled “Constructors”ToolApprovalRule()
Section titled “ ToolApprovalRule()”public ToolApprovalRule()Properties
Section titled “Properties”AgentName
Section titled “ AgentName”Gets the agent the rule holds for. When null it covers every agent of the tenant.
public string? AgentName { get; init; }Property Value
Section titled “Property Value”ArgumentConditions
Section titled “ ArgumentConditions”Gets the argument conditions. All conditions must match for the rule to apply
(AND); an empty list matches every call of the tool. Mutually exclusive
with ArgumentsHash — a rule carries one or the other, never both.
public IReadOnlyList<ToolArgumentCondition> ArgumentConditions { get; init; }Property Value
Section titled “Property Value”IReadOnlyList<ToolArgumentCondition>
ArgumentsHash
Section titled “ ArgumentsHash”Gets the argument fingerprint. When it is populated the rule covers only a call made with the same arguments.
public string? ArgumentsHash { get; init; }Property Value
Section titled “Property Value”CreatedAt
Section titled “ CreatedAt”Gets the creation time (UTC).
public required DateTimeOffset CreatedAt { get; init; }Property Value
Section titled “Property Value”CreatedBy
Section titled “ CreatedBy”Gets who created the rule, or null when there is no authentication.
public string? CreatedBy { get; init; }Property Value
Section titled “Property Value”Gets the rule id. A time-ordered UUID (v7).
public required Guid Id { get; init; }Property Value
Section titled “Property Value”SourceFingerprint
Section titled “ SourceFingerprint”Gets the fingerprint of the remote source the tool came from when the rule was written, or null for a tool that does not come from a remote source (a tool defined in code).
public string? SourceFingerprint { get; init; }Property Value
Section titled “Property Value”Remarks
Section titled “Remarks”For a tool of an MCP server it is the SHA-256 of the server’s endpoint address, as 64 upper-case hexadecimal characters. Tracon writes it when the rule is created; a caller does not supply it. The rule matches a call only while the tool’s current source has the same fingerprint, so pointing a server at another endpoint, or deleting it and adding it again under the same name with another endpoint, makes its tools ask again.
A rule written while the tool was not discovered, and a rule stored before this field existed, carry null and do not approve a tool of an MCP server. A store keeps the value as given and treats it as part of the rule’s identity, like ToolApprovalRule.ArgumentsHash.
TenantId
Section titled “ TenantId”Gets the tenant the rule holds in.
public required string TenantId { get; init; }Property Value
Section titled “Property Value”ToolName
Section titled “ ToolName”Gets the tool the rule holds for.
public required string ToolName { get; init; }Property Value
Section titled “Property Value”Methods
Section titled “Methods”Equals(object?)
Section titled “ Equals(object?)”public override bool Equals(object? obj)Parameters
Section titled “Parameters”obj object?
Returns
Section titled “Returns”Equals(ToolApprovalRule?)
Section titled “ Equals(ToolApprovalRule?)”public bool Equals(ToolApprovalRule? other)Parameters
Section titled “Parameters”other ToolApprovalRule?
Returns
Section titled “Returns”GetHashCode()
Section titled “ GetHashCode()”public override int GetHashCode()Returns
Section titled “Returns”ToString()
Section titled “ ToString()”public override string ToString()Returns
Section titled “Returns”Operators
Section titled “Operators”operator ==(ToolApprovalRule?, ToolApprovalRule?)
Section titled “ operator ==(ToolApprovalRule?, ToolApprovalRule?)”public static bool operator ==(ToolApprovalRule? left, ToolApprovalRule? right)Parameters
Section titled “Parameters”left ToolApprovalRule?
right ToolApprovalRule?
Returns
Section titled “Returns”operator !=(ToolApprovalRule?, ToolApprovalRule?)
Section titled “ operator !=(ToolApprovalRule?, ToolApprovalRule?)”public static bool operator !=(ToolApprovalRule? left, ToolApprovalRule? right)Parameters
Section titled “Parameters”left ToolApprovalRule?
right ToolApprovalRule?