# ToolApprovalRule

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.toolapprovalrule/
> Summary: ToolApprovalRule: A persistent approval rule for a tool call the user said "do not ask again" for.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.Abstractions.dll</code></div>

A persistent approval rule for a tool call the user said "do not ask again" for.

```csharp
public sealed record ToolApprovalRule : IEquatable<ToolApprovalRule>
```

<dl class="api-relations"><dt>Inheritance</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object">object</a> ← <a href="/api/tracon.toolapprovalrule/">ToolApprovalRule</a></dd><dt>Implements</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.iequatable-1">IEquatable&lt;ToolApprovalRule&gt;</a></dd><dt>Inherited Members</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object.gettype">object.GetType()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.tostring">object.ToString()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object)">object.Equals(object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object-system-object)">object.Equals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.referenceequals">object.ReferenceEquals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.gethashcode">object.GetHashCode()</a></dd></dl>

## Remarks

A rule is bound to the triple **tenant + agent + tool**. An approval
given by one tenant does not hold in another tenant; this is a security boundary and
is not relaxed.

When `ArgumentsHash` is populated the rule covers only a call made with
*the same arguments*. When it is empty the rule covers every call of the tool.
The distinction exists because Microsoft Agent Framework offers two separate "always
approve" forms: `CreateAlwaysApproveToolResponse` and
`CreateAlwaysApproveToolWithArgumentsResponse`.

[ToolApprovalRule.ArgumentConditions](/api/tracon.toolapprovalrule/#Tracon_ToolApprovalRule_ArgumentConditions) is a third, admin-authored form: instead of an exact
argument fingerprint it carries a set of comparisons (for example "amount &lt;= 100")
evaluated on every call. It is mutually exclusive with `ArgumentsHash`.

## Constructors

### <a id="Tracon_ToolApprovalRule__ctor"></a> ToolApprovalRule\(\)

```csharp
public ToolApprovalRule()
```

## Properties

### <a id="Tracon_ToolApprovalRule_AgentName"></a> AgentName

Gets the agent the rule holds for. When [null](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) it covers every
agent of the tenant.

```csharp
public string? AgentName { get; init; }
```

#### Property Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)?

### <a id="Tracon_ToolApprovalRule_ArgumentConditions"></a> ArgumentConditions

Gets the argument conditions. All conditions must match for the rule to apply
(`AND`); an empty list matches every call of the tool. Mutually exclusive
with `ArgumentsHash` — a rule carries one or the other, never both.

```csharp
public IReadOnlyList<ToolArgumentCondition> ArgumentConditions { get; init; }
```

#### Property Value

 [IReadOnlyList](https://learn.microsoft.com/dotnet/api/system.collections.generic.ireadonlylist\-1)<[ToolArgumentCondition](/api/tracon.toolargumentcondition/)\>

### <a id="Tracon_ToolApprovalRule_ArgumentsHash"></a> ArgumentsHash

Gets the argument fingerprint. When it is populated the rule covers only a call
made with the same arguments.

```csharp
public string? ArgumentsHash { get; init; }
```

#### Property Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)?

### <a id="Tracon_ToolApprovalRule_CreatedAt"></a> CreatedAt

Gets the creation time (UTC).

```csharp
public required DateTimeOffset CreatedAt { get; init; }
```

#### Property Value

 [DateTimeOffset](https://learn.microsoft.com/dotnet/api/system.datetimeoffset)

### <a id="Tracon_ToolApprovalRule_CreatedBy"></a> CreatedBy

Gets who created the rule, or [null](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when there is no authentication.

```csharp
public string? CreatedBy { get; init; }
```

#### Property Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)?

### <a id="Tracon_ToolApprovalRule_Id"></a> Id

Gets the rule id. A time-ordered UUID (v7).

```csharp
public required Guid Id { get; init; }
```

#### Property Value

 [Guid](https://learn.microsoft.com/dotnet/api/system.guid)

### <a id="Tracon_ToolApprovalRule_SourceFingerprint"></a> SourceFingerprint

Gets the fingerprint of the remote source the tool came from when the rule was
written, or [null](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) for a tool that does not come from a remote
source (a tool defined in code).

```csharp
public string? SourceFingerprint { get; init; }
```

#### Property Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)?

#### Remarks

For a tool of an MCP server it is the SHA-256 of the server's endpoint
address, as 64 upper-case hexadecimal characters. Tracon writes it when the
rule is created; a caller does not supply it. The rule matches a call only
while the tool's current source has the same fingerprint, so pointing a
server at another endpoint, or deleting it and adding it again under the
same name with another endpoint, makes its tools ask again.

A rule written while the tool was not discovered, and a rule stored before
this field existed, carry [null](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) and do not approve a tool of
an MCP server. A store keeps the value as given and treats it as part of the
rule's identity, like [ToolApprovalRule.ArgumentsHash](/api/tracon.toolapprovalrule/#Tracon_ToolApprovalRule_ArgumentsHash).

### <a id="Tracon_ToolApprovalRule_TenantId"></a> TenantId

Gets the tenant the rule holds in.

```csharp
public required string TenantId { get; init; }
```

#### Property Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)

### <a id="Tracon_ToolApprovalRule_ToolName"></a> ToolName

Gets the tool the rule holds for.

```csharp
public required string ToolName { get; init; }
```

#### Property Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)

## Methods

### <a id="Tracon_ToolApprovalRule_Equals_System_Object_"></a> Equals\(object?\)

```csharp
public override bool Equals(object? obj)
```

#### Parameters

`obj` [object](https://learn.microsoft.com/dotnet/api/system.object)?

#### Returns

 [bool](https://learn.microsoft.com/dotnet/api/system.boolean)

### <a id="Tracon_ToolApprovalRule_Equals_Tracon_ToolApprovalRule_"></a> Equals\(ToolApprovalRule?\)

```csharp
public bool Equals(ToolApprovalRule? other)
```

#### Parameters

`other` [ToolApprovalRule](/api/tracon.toolapprovalrule/)?

#### Returns

 [bool](https://learn.microsoft.com/dotnet/api/system.boolean)

### <a id="Tracon_ToolApprovalRule_GetHashCode"></a> GetHashCode\(\)

```csharp
public override int GetHashCode()
```

#### Returns

 [int](https://learn.microsoft.com/dotnet/api/system.int32)

### <a id="Tracon_ToolApprovalRule_ToString"></a> ToString\(\)

```csharp
public override string ToString()
```

#### Returns

 [string](https://learn.microsoft.com/dotnet/api/system.string)

## Operators

### <a id="Tracon_ToolApprovalRule_op_Equality_Tracon_ToolApprovalRule_Tracon_ToolApprovalRule_"></a> operator ==\(ToolApprovalRule?, ToolApprovalRule?\)

```csharp
public static bool operator ==(ToolApprovalRule? left, ToolApprovalRule? right)
```

#### Parameters

`left` [ToolApprovalRule](/api/tracon.toolapprovalrule/)?

`right` [ToolApprovalRule](/api/tracon.toolapprovalrule/)?

#### Returns

 [bool](https://learn.microsoft.com/dotnet/api/system.boolean)

### <a id="Tracon_ToolApprovalRule_op_Inequality_Tracon_ToolApprovalRule_Tracon_ToolApprovalRule_"></a> operator \!=\(ToolApprovalRule?, ToolApprovalRule?\)

```csharp
public static bool operator !=(ToolApprovalRule? left, ToolApprovalRule? right)
```

#### Parameters

`left` [ToolApprovalRule](/api/tracon.toolapprovalrule/)?

`right` [ToolApprovalRule](/api/tracon.toolapprovalrule/)?

#### Returns

 [bool](https://learn.microsoft.com/dotnet/api/system.boolean)