Keep model-visible arguments separate from host-owned identity, authorization, and credentials. The model expresses intent; the runtime resolves trusted context and capabilities.
Workflow
- Decide whether the integration is a built-in tool, custom tool, MCP server, Channel handler, or request-scoped client tool.
- Define the smallest model-visible JSON schema and separately define trusted bindings and Connection slots.
- Resolve user, tenant, resource, scope version, and grants server-side before tool execution.
- Package the complete relative source graph and validate it before upload.
- Resolve only active Connections with all required scopes and an unambiguous trusted binding.
- Execute with bounded time, cancellation, sandbox policy, idempotency, and redacted trace data.
- Test denied scope, missing/ambiguous Connection, rotated credentials, timeout, retry, malformed result, and package dependency failures.
Invariants
- Connection IDs and credentials are not model-controlled tool arguments.
ToolInvocationContextis copied, JSON-validated, deeply frozen, and host-owned.serverBindingscan read only supported immutable invocation paths.- Hidden bindings and Connection capabilities never enter model history or serialized tool arguments.
- A tool cannot widen its granted scopes, filesystem access, or execution surface.
- Packaging failure is detected before deployment; runtime 502 is not an acceptable dependency discovery mechanism.