angee.agents.grants

Pure-tuple REBAC grants governing which tools an agent may invoke.

TOOL_GRANT_RESOURCE_TYPE

REBAC definition whose pure-tuple objects are keyed by server-qualified tool id.

TOOL_GRANTEE_RELATION

Direct Agent.mcp_tools mirror relation on a tool-grant object.

RESOURCE_READER_ROLE

Built-in bundle granted to successfully provisioned in-process agents.

tool_grant_ref

def tool_grant_ref(server_sqid: str, tool_name: str) -> ObjectRef

Return the canonical v1 grant object for one server-qualified tool.

This is the sole constructor for tool-grant refs. Grant writers and runtime checkers must both call it so a later scoped-id revision cannot drift between persistence and authorization.

write_tool_grant

def write_tool_grant(server_sqid: str, tool_name: str,
                     agent: SubjectRef) -> None

Grant agent use of the named tool through the direct M2M mirror.

revoke_tool_grant

def revoke_tool_grant(server_sqid: str, tool_name: str,
                      agent: SubjectRef) -> None

Revoke agent's direct M2M-backed grant for the named tool.

builtin_mcp_server

def builtin_mcp_server() -> Any

Return the single catalogue row for the process-native Angee MCP server.

sync_builtin_tool_catalogue

def sync_builtin_tool_catalogue() -> int

Mirror the live built-in registry into its deterministic pinning catalogue.

The FastMCP registry remains execution truth. MCPTool rows are deliberately only the grant/pinning catalogue used by agent selections and REBAC ids; this sync updates that projection, prunes tools no longer registered in code, and owns the resource_reader bundle's generated-reader grants.

grant_resource_reader_role

def grant_resource_reader_role(agent: Any) -> None

Idempotently grant one provisioned in-process agent the reader bundle.

resync_tool_grants

def resync_tool_grants() -> int

Replace direct agent grants with the current Agent.mcp_tools selections.

Run after the current agents zed has been synced. Role and group grants are preserved: only ```grantee`@agents/agent`` tuples are reconciled. Returns the number of selected tool grants written.