The question.
Giving every agent a direct connection to every service makes permissions, debugging, and dependable execution difficult to reason about.
The gateway centralizes tool discovery and execution policy while keeping credentials outside prompts and separating read operations from writes.
The proposed approach.
- Expose narrow, validated tool contracts through protocol adapters
- Scope service access to the current task and tenant
- Apply timeouts, quotas, idempotency keys, and explicit write policies
- Record sanitized execution metadata for debugging and evaluation
Target architecture.
Agent requestTool registryPolicy and schema validationService adapterExecution ledgerResult
The difficult parts.
- Provider-specific semantics behind similar tool names
- Credential and tenant isolation
- Safe retries for side-effecting operations
How to evaluate it.
- Schema and policy rejection correctness
- Failure recovery and idempotency under retries
- Tool latency, isolation, and trace completeness
Planned deliverables.
- A typed tool-registry specification
- An execution-policy and audit model
- A provider-adapter conformance test plan
Design principles.
Expose the smallest useful tool contract.
Record effects separately from the text describing them.