Skip to main content

Tier Policy

Control which tools an agent can use — set a ceiling per scope, and agents can only call tools at or below that tier.

The problem​

You connect an MCP server to WardenAuth. That server exposes tools: some safe (search, list), some risky (delete, deploy, transfer). You want agents to use the safe tools freely but limit access to the dangerous ones. Without a tier system, you're managing per-tool permissions for every agent — which doesn't scale.

How it works​

Each MCP tool is assigned a tier: low, medium, or high. The tier policy sets a ceiling — an agent can only use tools at or below the configured tier.

A child scope can only reduce the tier, not increase it. If the org allows high but a workspace restricts to medium, the workspace's agents are capped at medium.

Viewing the effective policy​

GET /v1/admin/scope/{scopeId}/tier-policy
Authorization: Bearer <management-key>
{
  "maxTier": "medium",
  "inheritedFrom": "org-scope-id",
  "overrides": []
}

inheritedFrom shows which parent scope set this ceiling. Empty means it was set directly on this scope.

Updating​

PUT /v1/admin/scope/{scopeId}/tier-policy
Authorization: Bearer <management-key>

{ "maxTier": "low" }

Setting a tier restricts all tools in that scope and its children to that tier or lower. A tool configured as high in a scope with maxTier: low is effectively disabled — it won't appear in the tool list agents can call.