Get the Tenant's tool policy
managementKeyAuthorizationBearer <token>A management key of the Tenant (role management): it reaches the Management API (/v1/tenant/*) and /v1/me, as itself, never for a subject. Issued only on the Tenant's machine (nylorun-operate keys put <id> --role management) or from NYLORUN_MANAGEMENT_KEY_FILE. Never accepted from a browser (Origin).
Nylorun-Protocol*stringThe protocol version, 18
The rules the Tool Gate applies to every MCP and HTTP tool call
application/json- response
rules*array<>updatedAt*string|nullimport { createAdmin } from "@nylorun/admin";const admin = createAdmin();const policy = await admin.toolPolicy.get();{ "rules": [ { "effect": "allow", "tool": "string", "server": "string", "kind": "mcp", "agent": "string", "when": { "property1": { "equals": "string", "in": [ "string" ], "gt": 0, "gte": 0, "lt": 0, "lte": 0, "matches": "string" }, "property2": { "equals": "string", "in": [ "string" ], "gt": 0, "gte": 0, "lt": 0, "lte": 0, "matches": "string" } }, "reason": "string" } ], "updatedAt": "string"}Set the Tenant's model budgets PUT
Replaces every budget. Before each model call the gate checks the scope's spend against its cap; once a cap is reached the call fails with `budget_exhausted` and the turn with `model.budget_exhausted`. An empty list removes every cap.
Set the Tenant's tool policy PUT
Replaces every rule. The Tool Gate applies them to each MCP and HTTP tool call of every harness, before it sends the call: the strictest rule that matches decides. `deny` refuses the call (the model gets `tool.denied`), `ask` holds it and pauses the turn until a person answers it with an `approve` command on the session, `allow` runs it. A call no rule matches runs. A rule matches when every selector it sets matches: `tool` (the tool's identity: an MCP tool's own name on its `server`, or an HTTP tool's declared name, never the name the model calls it by; `*` matches any run of characters), `server` (an MCP server's name), `kind` (`mcp` or `http`), `agent` (the agent that calls it: the agent manifest's name, or the id of an agent used as a tool or of a flow's agent, never an Agent's id) and `when` (fields of the call's input by dotted path, each tested with `equals`, `in`, `gt`, `gte`, `lt`, `lte` or `matches`). A `tool` with `__` in it, a model-facing `server__tool` name, is refused (`400`): name an MCP tool by `server` and `tool`. A stored policy with such a rule refuses every call until it is set again. Sandbox tools never cross the gate. An empty list allows every call.