Access Engine
Permission matrices and access gating with access_enforce.
What you will learn
- access_get
- access_plan
- access_enforce
Prerequisites
Surface
| MCP | access_get · access_validate · access_enforce · access_plan |
|---|---|
| Config | .ags/access.yml |
What this feature does
Access Engine evaluates permission matrices for tools, environments, and secrets. Pair with identity principals.
How to call it
Call these MCP tools through your AGS / tower-gov host — access_get, access_validate, access_enforce, access_plan.. Prefer scan/get before validate/diff, and enforce only when the change set is ready.
- access_get
- access_plan
- Apply remediation
- access_enforce
{
/* Example MCP call — fill args from schema_get / docs */
"tool": "access_get",
"arguments": {}
}What success looks like
access_enforce ok
Policy matches live state
Common failure modes
Config enabled but requiredFiles missing
Enforce without validate
Plan ignored