Agent Autonomy & Tool Entitlements

In TRUSTIVAN, an AI agent is treated as an autonomous non-human principal with distinct authority boundaries. Rather than granting broad ambient permissions to an LLM or an MCP server, TRUSTIVAN enforces strict autonomy declarations and explicit tool entitlements.

1. Declaring Agent Autonomy

An agent’s autonomy level determines how much oversight is required before mutating actions are executed:

Autonomy Level	Description	Runtime Gate Policy
`manual`	Agent suggests actions; every execution requires human approval	Mutating actions (`write`, `administrative`) always trigger `CHALLENGE`
`semi_autonomous`	Agent operates within pre-approved parameters; elevated actions challenge	Non-critical `write` actions allowed if covered by tool entitlements
`autonomous`	Agent executes routine operations independently	Allowed for entitled tools; challenges only on high-impact resources or anomalies

Declare or update an agent’s autonomy using the API:

curl -s -X PATCH https://app.trustivan.com/nhi/api/v1/agents/{identityId}/autonomy \
  -H "Authorization: Bearer $ADMIN_SESSION" \
  -H "Content-Type: application/json" \
  -d '{
    "autonomyLevel": "semi_autonomous",
    "rationale": "Approved for automated customer support triage and ticket tagging"
  }'

If an agent’s autonomy has never been declared, rule agent_autonomy_undeclared challenges any mutating action by default.

2. Tool Classification & Effects

When an MCP connector discovers tools (tools/list), each tool is recorded with an initial action class derived from publisher annotations:

read: Read-only queries, status checks, and data fetches.
write: Modifies data, creates records, or triggers notifications.
administrative: Deletes entities, modifies roles, or provisions credentials.
unknown: Any tool without verifiable annotations (treated as potentially mutating).

An Organization Admin can review and override tool effects:

curl -s -X PATCH https://app.trustivan.com/nhi/api/v1/tools/{toolId}/effect \
  -H "Authorization: Bearer $ADMIN_SESSION" \
  -H "Content-Type: application/json" \
  -d '{
    "effect": "write",
    "notes": "Creates GitHub pull requests and issues"
  }'

3. Granting Explicit Tool Entitlements

By default, an identity has zero tool entitlements. Any attempt to invoke an unentitled tool is denied immediately by the mandatory rule tool_not_entitled. To grant an identity entitlement to invoke a tool:

curl -s -X POST https://app.trustivan.com/nhi/api/v1/tools/entitlements \
  -H "Authorization: Bearer $ADMIN_SESSION" \
  -H "Content-Type: application/json" \
  -d '{
    "identityId": "agent-pr-bot-01",
    "toolId": "tool-github-create-pr",
    "maxActionClass": "write",
    "resourceScope": "repo:acme/web-frontend"
  }'

4. Blast Radius Boundaries

TRUSTIVAN combines tool entitlements with the Machine Identity Graph to compute effective blast radius:

Downstream Resources: What databases, buckets, or repositories can this tool mutate?
Resource Criticality: Is the target resource marked as high or critical?
Quarantine Propagation: If a credential or workload is quarantined, all associated agent sessions are severed immediately.

When an agent requests an action on a critical resource without an active approval grant, rule mutating_action_on_high_impact_resource intercepts the call and raises a challenge.

Next Steps

Runtime Gate: Full breakdown of all 13 mediation rules.
MCP Server Guardrails: Connect MCP servers and isolate tools.
Governance & Audit: Review immutable decision logs.

Get started

Inventory

Govern

Reference

Agent Autonomy & Tool Entitlements

1. Declaring Agent Autonomy

2. Tool Classification & Effects

3. Granting Explicit Tool Entitlements

4. Blast Radius Boundaries

Next Steps

​1. Declaring Agent Autonomy

​2. Tool Classification & Effects

​3. Granting Explicit Tool Entitlements

​4. Blast Radius Boundaries

​Next Steps

1. Declaring Agent Autonomy

2. Tool Classification & Effects

3. Granting Explicit Tool Entitlements

4. Blast Radius Boundaries

Next Steps