Skip to content
Action plane · Tool Gateway

Authorize tools at the effect boundary

Every adapter is brokered through the Tool Gateway: typed envelopes, declared ActionRisk, a v1 compatibility projection, exact current approval, active containment, provider reconciliation, and scoped evidence.

MCP 2026-07-28 / A2A 1.0 / OpenAPI / custom — one ContextOS envelope shape, one policy boundary.

This is the adapter contract and reference architecture. Your runtime or managed tool service supplies the gateway, scoped credentials, and postcondition checks. Connectivity does not grant authority. Current owner and ancestor scopes, exact action approval with entitled quorum, active credential/data controls and external preconditions remain independent.

Abstract ContextOS Tool Gateway visual showing typed envelopes, approval gates, identity rails, trace rails, and enterprise adapters.
Action-plane gateway

Mediate every effect through current authority, exact approval, active boundaries and provider recovery.

Tool GatewayAdapter registryActionRiskv1 modeIdentityEvidence
Before any tool call
  1. 01Discover capability

    Resolve the adapter from intent, not a raw catalog dump.

  2. 02Evaluate risk

    Check effect, authority, reversibility, interaction, and data scope independently.

  3. 03Propagate identity

    Verify owned scope and every ancestor restriction; never forward raw credentials through the model.

  4. 04Protect writes

    Protect operation identity and reconcile uncertainty using verified provider semantics.

  5. 05Record evidence

    Return tool results with policy, trace, and evidence refs.

Illustrative integration targets. Capabilities and versions depend on your runtime; these cards do not advertise installed or certified connectors.

PostgreSQL

Database
per capability
Example
integration target

Snowflake

Warehouse
per capability
integration target

Salesforce

CRM
per capability
Example
integration target

HubSpot

CRM
per capability
integration target

Linear

Issue Tracker
per capability
Example
integration target

Jira

Issue Tracker
per capability
integration target

Slack

Communication
per capability
Example
integration target

Notion

Knowledge Base
per capability
integration target

Build an adapter

View Build Guide
Native risk and compatibility

Every capability declares native action risk

Adapters declare what they can do and classify each capability by effect, authority, reversibility, interaction, and data scope. The Tool Gateway decides whether the call happens against the actual arguments. The adapter-level approval_mode remains the v1 compatibility ceiling; it is not the full risk model.

See the Adapter Mesh foundation and the native action-risk contract. See the execution contract for protected atomic state, generation fencing, conserved shared budgets and uncertain effects, and the conformance guide for current useful, denial and fault evidence. All nine data stages and derived copies remain governed by actual processors, purpose, retention and propagation receipts.

illustrative AdapterDefinition — declaration is not authorization
adapter_id: adp_payments
type: OPENAPI
endpoint_ref: registry:payments-example
capabilities: [payments.issue_refund]
approval_mode: destructive # v1 compatibility ceiling
capability_risks:
  payments.issue_refund:
    effect: external_state
    authority: human_approved
    reversibility: compensatable
    interaction: api
    data_scope: CONFIDENTIAL