Fine-Grained Authorization: How Fine Is Fine Enough?

Fine grained authorization is access control that decides about small units rather than whole systems — one named resource instead of a resource type, one action instead of full access, one tool instead of a server, one call instead of a standing grant. The mechanism can be roles, attributes, or policy code; granularity is the size of what is decided, not how.

As fine as the risk requires, no finer than you can audit. For each level you add, ask whether you can still answer “who can do what to this resource” from a table rather than an investigation. Subject and action granularity are cheap. Resource and per-call granularity carry real review cost, so spend them where an operation is irreversible or externally visible.

Tool level permissions decide which individual tools on a server an agent can call. Agents need them because an agent picks its own tools from whatever it discovers, and its inputs can be adversarial — a poisoned document can steer it toward a destructive one. Disabling a tool in TrueFoundry omits it from tools/list and blocks invocation, so the model cannot choose what it cannot see. What is MCP authorization covers the surrounding model.

Yes. TrueFoundry runs in your VPC, on-prem, air-gapped, or hybrid, so prompts and responses never leave your domain even as you route across many providers.

Yes. It includes an MCP Gateway, an Agent Gateway, and an MCP & Agents Registry with tool-level access control. Agents on LangGraph, CrewAI, AutoGen, or a custom framework can all be governed centrally.

Sí. La pasarela es compatible con OpenTelemetry y se integra con Grafana, Datadog, Prometheus o tu pila preferida. Rastrea cada solicitud desde la instrucción (prompt) hasta la ejecución de la herramienta y el modelo, así obtienes un registro unificado sin tener que reemplazar lo que ya tienes en funcionamiento.