Verify Agent Action
vizier_verify_actionEvaluate whether an AI agent should be allowed to perform a proposed action.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent | Yes | ||
| grant | No | ||
| action | Yes | ||
| context | Yes | ||
| authority | Yes | ||
| principal | Yes |
vizier_verify_actionEvaluate whether an AI agent should be allowed to perform a proposed action.
| Name | Required | Description | Default |
|---|---|---|---|
| agent | Yes | ||
| grant | No | ||
| action | Yes | ||
| context | Yes | ||
| authority | Yes | ||
| principal | Yes |
Changes observed during successful MCP inspections.
Input schema / properties / authority / properties / constraints / properties / quorumAdded value: +{
+ "additionalProperties": false,
+ "properties": {
+ "allowed_approvers": {
+ "items": {
+ "maxLength": 2048,
+ "minLength": 1,
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "max_age_seconds": {
+ "maximum": 86400,
+ "minimum": 1,
+ "type": "integer"
+ },
+ "min_approvals": {
+ "maximum": 10,
+ "minimum": 1,
+ "type": "integer"
+ },
+ "require_distinct_owners": {
+ "type": "boolean"
+ }
+ },
+ "required": [
+ "min_approvals"
+ ],
+ "type": "object"
+}Input schema / properties / context / properties / approvalsAdded value: +{
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "action_hash": {
+ "pattern": "^[a-f0-9]{64}$",
+ "type": "string"
+ },
+ "approver_id": {
+ "maxLength": 256,
+ "minLength": 1,
+ "type": "string"
+ },
+ "approver_owner": {
+ "maxLength": 256,
+ "minLength": 1,
+ "type": "string"
+ },
+ "decision": {
+ "default": "APPROVE",
+ "enum": [
+ "APPROVE",
+ "REJECT"
+ ],
+ "type": "string"
+ },
+ "grant_token": {
+ "type": "string"
+ },
+ "notes": {
+ "maxLength": 1024,
+ "type": "string"
+ },
+ "signature": {
+ "type": "string"
+ },
+ "timestamp": {
+ "format": "date-time",
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+ "type": "string"
+ }
+ },
+ "required": [
+ "approver_id",
+ "action_hash",
+ "timestamp",
+ "decision"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+}Input schema / properties / context / properties / proposal_idAdded value: +{
+ "pattern": "^prp_[0-9a-zA-Z_-]+$",
+ "type": "string"
+}Input schema / properties / authority / properties / constraints / properties / allowed_dlp_categoriesAdded value: +{
+ "items": {
+ "maxLength": 2048,
+ "minLength": 1,
+ "type": "string"
+ },
+ "type": "array"
+}Input schema / properties / authority / properties / constraints / properties / dlp_screeningAdded value: +{
+ "type": "boolean"
+}Input schema / properties / authority / properties / constraints / properties / blocked_entitiesAdded value: +{
+ "items": {
+ "maxLength": 2048,
+ "minLength": 1,
+ "type": "string"
+ },
+ "type": "array"
+}Input schema / properties / authority / properties / constraints / properties / sanctions_screeningAdded value: +{
+ "type": "boolean"
+}Input schema / properties / authority / properties / constraints / properties / cool_off_secondsAdded value: +{
+ "maximum": 86400,
+ "minimum": 1,
+ "type": "number"
+}Input schema / properties / authority / properties / constraints / properties / max_repeated_callsAdded value: +{
+ "maximum": 100,
+ "minimum": 1,
+ "type": "integer"
+}Input schema / properties / authority / properties / constraints / properties / max_session_actionsAdded value: +{
+ "maximum": 10000,
+ "minimum": 1,
+ "type": "integer"
+}Input schema / properties / authority / properties / constraints / properties / time_window_secondsAdded value: +{
+ "maximum": 3600,
+ "minimum": 1,
+ "type": "number"
+}Input schema / properties / context / properties / session_idAdded value: +{
+ "maxLength": 256,
+ "minLength": 1,
+ "type": "string"
+}Input schema / properties / grantAdded value: +{
+ "maxLength": 8192,
+ "minLength": 1,
+ "type": "string"
+}Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly=true, idempotent=true, destructive=false, so the safety profile is covered. The description adds only the fact that this is a gatekeeping evaluation, without disclosing latency, failure modes, whether a decision is cached, or how a denied action should be handled — meaningful gaps for a policy-decision tool, but not a contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or repetition. It is efficiently written, though arguably too terse given the structural complexity of the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool requiring five mandatory, deeply nested inputs (agent identity, principal, action descriptor, authority constraints, request context) and with no output schema, one sentence is far from sufficient. It omits what inputs matter, how authority constraints affect the outcome, and what the response contains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across six parameters, five of them required, including deeply nested objects (agent, action, authority with its quorum/amount/target constraints, context with approvals). The description mentions none of them, so it fails to compensate for the coverage gap; only the parameter names themselves offer any hint.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and purpose: evaluate whether an AI agent may perform a proposed action. It is unambiguous and actionable, though it never states what the evaluation returns (an allow/deny verdict) or the policy framework it checks against. No siblings exist, so differentiation is moot.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer it should call this before permitting an action, but there is no explicit guidance on ordering, prerequisites, what to do with the verdict, or whether a rejection is final. No alternatives are named, though none exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.