Policy and scopes

Restricting which tools an account can reach, by server, by tool, and by what a grant allows.

Policy is the last decision Omniio makes before a tool call can leave the gateway. It is set per tool, with a bulk control when every tool from one server should follow the same rule.

The three modes#

Allowed: Run immediately, unless the upstream definition has a material change waiting for review. This is the default for a tool on an enabled server.
Ask first: Open an approval request for the exact arguments and wait for a person to approve or deny this call.
Denied: Refuse before contacting the upstream server or opening its stored credential. The refusal is written to Activity.

Open Tools to change one row, or choose a mode for the server to apply it to every tool currently in that server's catalogue. A bulk choice is a convenience, not a fourth kind of rule: each named tool ends up with the selected mode and can be changed separately afterwards.

The Omniio tools page listing tools by server with Allowed, Ask first and Denied policy controls — Policy sits beside the catalogue entry it controls, with a bulk setting for the server above it.

Setting a tool back to Allowed removes its exception and returns it to the default. Rules are keyed to the server slug and upstream tool name, rather than to a temporary catalogue row. They survive a refresh, a short disappearance and the tool being advertised again later under the same qualified name.

Enforcement order#

For run_tool, Omniio resolves the enabled server and tool, then evaluates its policy before making an upstream request.

0 of 4 done

Denied stops inside Omniio
No request reaches the upstream and its credential is not decrypted. A failed audit entry explains that policy refused the call.
Ask first looks for one matching decision
A previously approved, unspent request for this qualified name and these exact arguments is claimed. Without one, Omniio opens an approval and holds or returns the approval URL.
Allowed checks the tool definition
A material, unreviewed upstream change temporarily makes an Allowed tool behave like Ask first. Otherwise the call proceeds.
The upstream grant is used
Only now does Omniio open the stored credential and contact the server.

An existing Ask first rule stays Ask first after a definition change, and a Denied rule stays denied. Change detection cannot loosen either one.

Policy is not an OAuth scope#

An upstream OAuth grant defines what its token is capable of doing. Omniio's policy decides which of the tools inside that grant your agent may actually reach.

text

upstream OAuth grant  ⊇  server tools  ⊇  tools allowed by Omniio policy

Policy can narrow a grant; it cannot widen one. Marking a tool Allowed does not give its token a missing provider scope, bypass a provider role or make an operation available that the upstream account cannot perform. In that case the upstream rejects the call and Omniio records its response.

Likewise, the OAuth access token issued to an MCP client is bound to the Omniio MCP endpoint. It does not become a REST API key and does not grant direct access to an upstream server.

Next: Tool change detection.