Enforce the decision where the tool runs.
This reference design places the policy check and privileged credentials outside the agent’s runtime.
Evaluate the complete request
Authenticate the caller. Evaluate the agent identity, delegated user or service, action, resource, and validated arguments against the applicable policy. Treat tool descriptions and model output as request data.
If the executor can’t determine whether a privileged action is authorised, keep the tool call blocked.
Recheck after approval
Record the reviewer’s decision against the exact normalised request. Before execution, check the reviewer’s authority, approval expiry, request identity and current policy. Use a stable operation ID and the downstream tool’s idempotency controls where available.
Close the direct path
Keep privileged credentials with the trusted executor. A direct call is blocked only if the protected endpoint rejects the agent’s credentials or is unreachable from the agent environment. Evaluate alternate MCP connections and any shared service accounts as separate paths.
Separate authorisation from execution
Record the policy rule, decision, approval reference and operation ID. Log the downstream result separately so an allowed call with an unknown outcome remains distinguishable from a completed action.
Continue the workflow with Romulus
Romulus, also by New Odyssey, covers durable execution, saved checkpoints and persistent waits. Pair those capabilities with Remus when an agent workflow needs to survive a restart or wait for a human decision.
For a refund workflow, retain the proposed action and correlation ID in the execution record while Remus holds the tool call for review. A matching approval event can resume the workflow. The executor must still recheck the exact request, approval expiry and current policy before calling the payment tool.