Safe API access

Expose useful authority without handing agents raw credentials.

Gateway capabilities wrap integrations, APIs, packages, imported MCP tools, and custom runtime code in scoped grants, workspace ownership, Activity, and human review behavior.

Capability Anatomy

A capability is not just an MCP tool name on an allowlist. ExecWarden evaluates the current caller, live grant, capability definition, scope, policy attachments, lifecycle, and approval state before dispatch. Current integrations then add resource, argument, time, and provider-specific checks where those semantics are implemented.

Action	The capability name, such as `github:access_remote`, `github:pull_requests.create`, `pkg:<workspace-segment>:linear-lite:viewer.get`, or `mcp:<workspace-segment>:<connection-segment>:comments_create`.
Resource	The Git remote repo, GitHub repo, Drive file, package, external MCP connection, workflow, or workspace-owned secret surface where the integration enforces that dimension.
Arguments	Runtime parameters such as a Git ref being pushed, owner/repo, Drive fileId, package params covered by manifest scope rules, external MCP tool args, or exact params on an approved call.
Scope	Canonical grant scopes such as Git repo allowlists, branch patterns, package scope objects, selected Drive files, external MCP connection/tool constraints, and workspace ownership.
Time	Canonical grants can be bounded by use count or expiry. Agent identities can also carry an `expiresAt` timestamp, and can still be disabled or revoked.
Caller	The bearer Agent identity token, hosted session, workflow run, workspace, and label recorded with the request and approval trail.

Where Capabilities Come From

Built-in integrations

GitHub, Google Workspace Drive, MCP connections, and registered capability packages expose normalized capability definitions.

MCP clients

External callers use bearer-scoped MCP to discover only the tools their key can see.

Capability packages

Custom registry packages turn APIs into governed tools with package-local secrets and runtime code.

Workflow functions

Workflow management functions let agents create, update, trigger, and inspect repeatable jobs.

Default Access Modes

Off	The agent or workflow should not see or rely on this capability.
Ask first	The capability is visible and requestable, but execution requires an approval outcome.
Allowed	The capability can execute without another approval when arguments match the configured scope.
Package input	A granted package action can still return a human input request when the integration needs a decision, value, reason, or resume signal.

Concrete GitHub Policy

This grant shape lets a Codex MCP caller discover two repos and use the gateway Git remote for those repos, but pushes are accepted only for matching branches. The transparent Git remote rejects repos outside the list, rejects main/master, and rejects branches outside the allowlist before proxying to GitHub. GitHub REST tools also reject owner/repo params outside the same repo list.

Caller	A named Agent identity such as Codex repo review.
Capability	GitHub remote access through `github:access_remote`.
Mode	Allowed for matching clone, fetch, and review-branch push operations.
Repos	Only selected repos, such as `acme/api` and `acme/web`.
Push branches	Only allowed branch patterns, such as `agent/*`.
Lifetime	Use identity expiry, grant expiry, or use limits for temporary authority.
Capture	Use metadata capture for routine Git transport, and exact approval payloads for Ask-mode REST writes.

May read	The caller can discover acme/api and acme/web through github:repos.list and clone/fetch those repos through the gateway Git remote. GitHub REST reads must target an owner/repo in the same repo allowlist.
May push	Only refs such as `refs/heads/agent/pr-142`. Pushes to `main`, `master`, or `release/*` are denied by the smart-HTTP receive-pack policy.
Must ask	Capabilities in Ask mode can return `pendingApprovalId` for an exact call payload before execution.
Cannot do	No merge authority is granted unless `github:pull_requests.merge` is explicitly granted. No raw GitHub PAT is exposed to the MCP client.
Expires	Use canonical grant use limits or expiry for temporary authority. Use Agent identity `expiresAt` for the caller credential window, and revoke or disable the identity when access should stop immediately.
Next question	Use Approvals & Policy for Ask-mode writes, or Security Model for what evidence to inspect after a run.