Docs menu

Access Engine

Permission matrices and access gating with access_enforce.

What you will learn

  • access_get
  • access_plan
  • access_enforce

Prerequisites

Surface

MCPaccess_get · access_validate · access_enforce · access_plan
Config.ags/access.yml

What this feature does

Access Engine evaluates permission matrices for tools, environments, and secrets. Pair with identity principals.

How to call it

Call these MCP tools through your AGS / tower-gov host — access_get, access_validate, access_enforce, access_plan.. Prefer scan/get before validate/diff, and enforce only when the change set is ready.

  1. access_get
  2. access_plan
  3. Apply remediation
  4. access_enforce
MCP: access_enforce json
{
  /* Example MCP call — fill args from schema_get / docs */
  "tool": "access_get",
  "arguments": {}
}

What success looks like

access_enforce ok

Policy matches live state

Common failure modes

Config enabled but requiredFiles missing

Enforce without validate

Plan ignored

Related reference

AGS documentation