Stéphane Tailland
f6aa695c83
Cluster-scoped and platform-owned: every domain gateway asks the same server, so a rule is written once rather than five times. The policy has an opinion about arguments and none about anything else — the handshake, the tool listing and the REST surface pass untouched. Two rules today: a cap on how much one call may read, which is what a request-counting rate limit cannot see, and a bound on a unit price, which is the parameter that turns a permitted write into an expensive mistake. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
74 lines
2.5 KiB
Rego
74 lines
2.5 KiB
Rego
# Authorisation on tool-call *parameters*, not just the tool name.
|
|
#
|
|
# The estate already answers "may this identity call this tool?" — the MCP
|
|
# server filters tool discovery by the caller's roles. What nothing answered is
|
|
# "may it call it with *these* arguments". `write` authorises writing; it does
|
|
# not authorise this particular record. A read cap counts calls; it does not
|
|
# stop one call asking for ten thousand rows.
|
|
#
|
|
# This runs at the gateway, so it holds whether the caller is an agent behaving
|
|
# itself, an agent that has been talked into something, or a person with curl.
|
|
|
|
package kong
|
|
|
|
import rego.v1
|
|
|
|
default allow := false
|
|
|
|
# Everything that is not an MCP tool call passes: the session handshake, the
|
|
# tool listing, the REST surface. This policy has an opinion about arguments
|
|
# and no opinion about anything else.
|
|
allow if not is_tool_call
|
|
|
|
allow if {
|
|
is_tool_call
|
|
count(violations) == 0
|
|
}
|
|
|
|
is_tool_call if {
|
|
input.request.http.parsed_body.method == "tools/call"
|
|
}
|
|
|
|
tool := input.request.http.parsed_body.params.name
|
|
|
|
args := object.get(input.request.http.parsed_body.params, "arguments", {})
|
|
|
|
# --- how much one call may read -------------------------------------------
|
|
#
|
|
# The rate limit counts requests. Without this, one request asking for a
|
|
# hundred thousand rows costs the same as one asking for ten — which is how a
|
|
# volume cap is defeated without breaking it.
|
|
max_page_size := 200
|
|
|
|
violations contains msg if {
|
|
size := to_number(object.get(args, "query_page_size", 0))
|
|
size > max_page_size
|
|
msg := sprintf("query_page_size %d exceeds the maximum of %d", [size, max_page_size])
|
|
}
|
|
|
|
# --- what one call may commit ---------------------------------------------
|
|
#
|
|
# A price is the parameter that turns a permitted write into an expensive
|
|
# mistake. The bound is deliberately wide: this is not pricing policy, it is a
|
|
# guard against a value that can only be an error or an attack.
|
|
max_unit_price := 100000
|
|
|
|
violations contains msg if {
|
|
body := object.get(args, "body", {})
|
|
some field in ["buyprice", "msrp"]
|
|
value := to_number(object.get(body, field, 0))
|
|
value > max_unit_price
|
|
msg := sprintf("%s %v exceeds the maximum of %d", [field, value, max_unit_price])
|
|
}
|
|
|
|
violations contains msg if {
|
|
body := object.get(args, "body", {})
|
|
some field in ["buyprice", "msrp"]
|
|
to_number(object.get(body, field, 1)) <= 0
|
|
msg := sprintf("%s must be greater than zero", [field])
|
|
}
|
|
|
|
# What the caller is told. A refusal that does not say which argument was
|
|
# refused sends someone looking in the wrong place.
|
|
reason := concat("; ", violations)
|