per-call authorization

In short: Per-call authorization means every tool call an agent makes is checked against policy at the moment it happens. A token granted at sign-in is not enough. Each call is evaluated for the agent, the person behind it, the tool and the action requested.

Where does it show up in practice?

Gateways are the usual place to enforce per-call authorization.

Related terms

• policy enforcement point
• mcp gateway
• allow ask deny