For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

Action Gateway enforces a tool policy on every session. The policy determines whether a tool call runs immediately, requires human approval, or is blocked. You define the policy and are responsible for matching it to the workload’s intended access.

Tool Selection and Permission Rules

The gateway first checks whether a catalog tool is in the session’s selection. A call outside that selection is denied regardless of any allow rule. It then evaluates the permission rules against the selected tool and its arguments.

These checks also apply to tools called through action_invoke, direct MCP calls, and the helper inside action_code. Tool discovery and preloading do not grant additional permissions.

Policy Actions

An omitted default action resolves to ask. Set it explicitly so the session’s intended behavior is clear. Broad allow defaults can authorize account changes, writes, and deletions without a prompt.

Rules identify a tool or versioned Toolbelt, an action, and optional argument conditions in match. More-specific matching rules take precedence. For equally specific matches, deny takes precedence over ask, and ask over allow. Do not rely on the order of Action Gateway rules to override a more-specific rule.

Permissions for Groups of Tools

Use a versioned Toolbelt reference in a rule to apply the same action to its member tools. For example, an ask rule for toolbelt:research@1 requires approval for calls to the tools in that group, unless a more-specific rule determines otherwise. An individual tool rule takes precedence over a Toolbelt rule.

If you restrict the session to selected tools, include the Toolbelt or its members in that selection. Selecting a group and assigning its permissions are separate steps. Each member call still needs the appropriate provider connection and authorization.

Approval and Credential Boundaries

The gateway can request approval through MCP elicitation when the client supports it. Other clients receive approval information that a person must resolve before retrying the same call. See Configure Server-Side Approval.

A tool policy does not reduce the scopes of the underlying provider credential. Grant least-privilege scopes at the provider and use gateway policy to constrain how the agent uses the connection. Session instructions are guidance, not an enforcement mechanism.