Skip to main content
Glama

record_processing_role

Record the data-processing role (controller, processor, sub-processor) for a store to comply with GDPR Art. 28, including controller details and sub-processor lists.

Instructions

Record who this store's operator is for the personal data in it (GDPR Art. 28): controller, joint_controller, processor or sub_processor. A processor names the controller and the written instructions_ref (28(3)), pinned by instructions_sha256; sub_processors lists {name, authorised_by, authorised_ts} (28(2)); purposes and categories describe the processing.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
tsNo
roleYes
actorYes
purposesNo
store_refNo
categoriesNo
controllerNo
sub_processorsNo
instructions_refNo
instructions_sha256No

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv3.5.1

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It explains the meaning of parameters (e.g., processor requires controller and instructions_ref) but does not describe the operation's side effects, whether it is a write/append/update, if it overwrites existing data, requires specific permissions, or returns anything. The 'record' verb implies a mutation, but details are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, dense paragraph that front-loads the core purpose and then details parameter relationships. It is not overly verbose and each clause adds value. Though it packs many details, it remains readable and structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 10 parameters, 0% schema coverage, no output schema, and no annotations, the description should cover all essential call aspects. It explains several parameters but omits required fields like actor and role, and does not describe return values, error conditions, or side effects. This makes it incomplete for accurate invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does explain the semantics of several parameters: role types (controller, etc.), controller and instructions_ref for processor, sub_processors structure, and purposes/categories. It does not explicitly explain required params actor and role, nor store_ref and ts, but the overall parameter meaning is reasonably conveyed. Given low schema coverage, this is strong compensation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool records the GDPR Art. 28 processing role (controller, joint_controller, processor, sub_processor) of a store's operator for personal data. It uses a specific verb ('record') and resource ('store's operator's role'), and even names the legal basis. This distinguishes it from sibling tools like record_oversight or record_lifecycle, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (recording a processing role) but does not explicitly contrast it with alternatives or state when not to use it. There is no mention of exclusions or alternative tools for related actions, so an agent might still confuse it with other record_* tools. However, the clear purpose provides implicit usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools