Assistant Tool Lattice Policy Mapping
Audience: policy authors and platform operators governing which tools the Advisory AI assistant may call.
This guide defines the tool lattice rule schema and the default scope mapping for assistant tool calls. The lattice is evaluated by the Policy Gateway, which returns an allow or deny decision for every tool request. For where the lattice is enabled in configuration, see Assistant parameters → Tool policy lattice.
Default-deny behaviour
- If no rule matches a tool request, the decision is deny.
- A rule must match the tool name, action, and any configured tenant, role, scope, or resource filters before it can allow access.
Rule fields
| Field | Description |
|---|---|
tool | Tool name or wildcard pattern (for example, vex.query or scanner.*). |
action | Read or action discriminator (for example, read or action). |
scopes | Required Authority scopes (one or more). |
roles | Optional role filters (one or more). |
tenants | Optional tenant filters (one or more). |
resource | Optional resource pattern (for example, sbom:component:*). |
effect | allow or deny. |
priority | Integer priority; higher values evaluate first. |
Default scope mapping
| Tool | Action | Required scopes |
|---|---|---|
vex.query | read | vex:read |
sbom.read | read | sbom:read |
scanner.findings.topk | read | scanner:read or findings:read |
Override guidance
- Use
priorityto override default rules; higher-priority rules are evaluated first. - Keep rules deterministic by using stable patterns and avoiding ambiguous overlaps.
Related
- Assistant parameters — configuration knobs for the assistant, including how the tool lattice is enabled.
- Policy DSL guide — authoring policy rules that gate assistant actions.