---
title: Tool Policies (public)
description: Action Gateway tool policies allow, require approval for, or deny calls within a session's selected catalog.
product: Managed Agents
url: https://docs.digitalocean.com/products/managed-agents/action-gateway/concepts/tool-policies/
last_updated: "2026-09-21"
---

> **For AI agents:** The documentation index is at [https://docs.digitalocean.com/llms.txt](https://docs.digitalocean.com/llms.txt). Markdown versions of pages use the same URL with `index.html.md` in place of the HTML page (for example, append `index.html.md` to the directory path instead of opening the HTML document).

# Tool Policies (public)

Action Gateway connects applications and AI agents to tools through a managed MCP endpoint or SDK, with the accounts and permissions you choose. See [What You Can Build](https://docs.digitalocean.com/products/managed-agents/action-gateway/details/what-you-can-build/index.html.md) for standalone agent examples.

Action Gateway enforces a tool policy on every session. The policy determines whether a tool call runs immediately, requires human approval, or is blocked. You define the policy and are responsible for matching it to the workload’s intended access.

## Tool Selection and Permission Rules

The gateway first checks whether a catalog tool is in the session’s selection. A call outside that selection is denied regardless of any allow rule. It then evaluates the permission rules against the selected tool and its arguments.

These checks also apply to tools called through `action_invoke`, direct MCP calls, and the helper inside `action_code`. Tool discovery and preloading do not grant additional permissions.

## Policy Actions

| Action | Behavior |
|---|---|
| `allow` | Run the tool without gateway approval. |
| `ask` | Require approval before the tool runs. The client must support the approval flow. |
| `deny` | Block the call. Approval cannot override a deny decision. |

An omitted default action resolves to `ask`. Set it explicitly so the session’s intended behavior is clear. Broad `allow` defaults can authorize account changes, writes, and deletions without a prompt.

Rules identify a tool or versioned [Toolbelt](https://docs.digitalocean.com/products/managed-agents/action-gateway/concepts/toolbelts/index.html.md), an action, and optional argument conditions in `match`. More-specific matching rules take precedence. For equally specific matches, `deny` takes precedence over `ask`, and `ask` over `allow`. Do not rely on the order of Action Gateway rules to override a more-specific rule.

## Permissions for Groups of Tools

Use a versioned Toolbelt reference in a rule to apply the same action to its member tools. For example, an `ask` rule for `toolbelt:research@1` requires approval for calls to the tools in that group, unless a more-specific rule determines otherwise. An individual tool rule takes precedence over a Toolbelt rule.

If you restrict the session to selected tools, include the Toolbelt or its members in that selection. Selecting a group and assigning its permissions are separate steps. Each member call still needs the appropriate provider connection and authorization.

## Approval and Credential Boundaries

The gateway can request approval through MCP elicitation when the client supports it. Other clients receive approval information that a person must resolve before retrying the same call. See [Configure Server-Side Approval](https://docs.digitalocean.com/products/managed-agents/action-gateway/how-to/configure-server-side-approval/index.html.md).

A tool policy does not reduce the scopes of the underlying provider credential. Grant least-privilege scopes at the provider and use gateway policy to constrain how the agent uses the connection. Session instructions are guidance, not an enforcement mechanism.