Skip to main content
Glama

Set file ACL

set_storage_file_acl
Destructive

Replace a fal CDN file's Access Control List to make it public or restrict access with default and per-user allow, forbid, or hide rules.

Instructions

Replaces the Access Control List of a fal CDN file.

The ACL consists of a default decision (allow, forbid, or hide) plus optional per-user rules that override the default. Rule users may be specified by nickname or user ID. Setting default to allow with no rules makes the file public; forbid or hide restricts it to the rules you provide.

Rules referencing users that do not exist are dropped. The response reflects the ACL actually applied, so verify it contains the rules you sent.

Authentication: Required. The API key must have the assets:write permission.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYesFull URL of the fal CDN file, as returned by the upload APIs (https://v3.fal.media/files/b/<id>/<filename>). Must not contain query parameters.
rulesNoUser-specific overrides to the default decision
accountNoExact private account key profile label, not an authenticated provider owner ID.
confirmNoMust be true for the requested mutation, paid work or private output file.
defaultNoFallback decision when no user-specific rule matches
payloadNoComplete native JSON body, mutually exclusive with flat body flags and payload_file. Use schema for union bodies.
payload_fileNoAbsolute regular non-symlink private JSON file, at most 1 MiB. Cannot mix with other body inputs.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv2.0.0

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations (which already cover destructive/read-only/idempotent/open-world) by disclosing the auth requirement ('assets:write' permission), the subtle dropping of rules referencing nonexistent users, and the need to verify the returned ACL. These are genuinely useful mutation behaviors not derivable from the hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Reasonably sized and front-loaded with the core action; each sentence carries substantive information. Slightly verbose with the formatting/bold auth line, but nothing is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, open-world mutation tool with no output schema, the description covers auth requirements, ACL semantics, edge-case behavior (dropped rules), and response verification. It leaves the `account`/`confirm`/`payload` body-variant parameters to the schema, which is acceptable given full schema coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3; the description rises above it by explaining the semantic consequence of the `default` enum values ('allow' with no rules makes the file public; 'forbid'/'hide' restricts) and the dropped-rule behavior for user rules. It adds meaning beyond the raw schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Replaces the Access Control List of a fal CDN file'), which cleanly distinguishes it from the read-only sibling get_storage_file_acl. An agent knows exactly what this tool mutates without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes the tool's purpose and effects ('makes the file public', 'restricts it to the rules you provide'), which implies when to use it, but it never explicitly states when to choose this over get_storage_file_acl or other storage tools. Usage is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.