Skip to main content
Glama

manage_operating_access_grant

Destructive

Owner/operator-only grant or revocation of one person's expiring access to one restricted operating-data class. Use the narrowest subject and class, explain the business purpose, cap access at 90 days, and revoke immediately when the engagement ends. Revocation is retained as an audit tombstone. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
actionYes
reasonYesSpecific reviewed purpose for granting or revoking access.
grantIdNoRequired for revoke; the immutable grant record to tombstone.
companyIdNocorply_companies.id. May be omitted only when the active organization has exactly one company.
dataClassNoRequired for grant; grant exactly one class at a time.
expiresAtNoRequired for grant; must be in the future and no more than 90 days away.
subjectIdNoOptional person/subject scope. Omit only for a genuinely company-wide fact class.
granteeUserIdNoRequired for grant; must be an active member of the organization.
_corply_contextNoEcho context_engineering.context_session from the prior Corply result.

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark destructiveHint true; the description goes further by disclosing that revocations are retained as audit tombstones, that the tool is canonical and should not trigger state-recovery calls, and that retries require checking idempotency first. This meaningfully characterizes the effects beyond the structured hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence front-loads the purpose and subsequent clauses are dense but purposeful. A small deduction for the dangling phrase 'every prerequisite stated above' and for boilerplate-like Canonicality/Idempotency sentences that could be sharper.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, conditionally-required 9-parameter tool, the description covers authorization, prerequisites, audit behavior, retry safety, and confirmation boundaries, and points at actual_tool_output/context_engineering so the agent knows what to trust. No output schema exists, but the critical invocation context is present; action-specific parameter requirements are left to the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is high (89%) and every parameter is documented in the schema, so the baseline applies; the description reinforces concepts like narrowest subject/class and the 90-day cap but adds little technical meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair: owner/operator-only grant or revocation of one person's expiring access to one restricted operating-data class. This clearly identifies the action domain and distinguishes it from the many fact/evidence recording siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete operating rules: use the narrowest subject and class, state a business purpose, cap access at 90 days, revoke when engagement ends, and get fresh user confirmation. It does not name sibling alternatives or explicit exclusion conditions, so it stops short of a perfect routing guide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

B3.4/5.0
Disambiguation3/5

There is notable overlap among status/read tools (get_company_briefing, get_status, get_org, whoami) and a dense cluster of payment-related tools (request_payment, await_payment, create_payment_project, create_payment_route_draft, etc.). The detailed descriptions help differentiate them, but agents could still misselect when the surface is this large.

Naming Consistency4/5

Tool names overwhelmingly follow a verb_noun snake_case pattern (e.g., create_payment_route_draft, record_operating_event, start_bank_onboarding). Minor exceptions like 'whoami', 'recall', and 'remember' are acceptable single-verb commands, so the naming is highly consistent overall.

Tool Count2/5

At 52 tools, the server far exceeds the 25+ threshold for 'too many'. While the breadth of domains (formation, payments, cap table, operating compliance) somewhat justifies the count, it still feels heavy and likely increases selection errors and cognitive load for agents.

Completeness4/5

The tool surface covers the full formation lifecycle (save, validate, generate, sign, submit), payment handling, bank onboarding, cap table management, and operating records/evidence workflows. Minor gaps exist (e.g., no update/delete for existing companies, no explicit company dissolution), but the core workflows are well covered.