Chapter 4 of 6
Decisions and stop conditions#
Accept the preview and portal boundary#
Set previewDecision.privateToolCatalog to accepted-for-approved-nonproduction-scope only after the named decision owner accepts the Azure preview terms and operating limits.
Set previewDecision.catalogDiscovery to confirmed-in-foundry-tools only after the operator opens the intended Microsoft Foundry project, goes to Build > Tools, filters by the API Center name, and sees the API Center MCP server record.
Stop if the record is absent. Check the API Center Data Reader assignment, the selected Foundry project, the API Center asset version and deployment, and the possible RBAC propagation delay. Do not bypass the catalog with an unreviewed custom MCP entry.
Reconcile the source record#
Copy the selected API Center asset, version, and deployment names into catalog-toolbox-binding.json. Put the runtime endpoint only in toolbox-version.json, then record its SHA-256 digest in sourceRecord.mcpEndpointSha256.
The API catalog owner compares the endpoint entered in Foundry with the current API Center deployment. A matching digest shows that both module files refer to the same endpoint without duplicating the endpoint in the governance record.
Stop if:
- the API Center lifecycle state is not approved;
- the deployment has no runtime URL;
- the endpoint differs between API Center, the project connection, and the Toolbox payload;
- the authentication method differs from the runtime security decision;
- the project connection is missing or belongs to another project; or
- the selected MCP server exposes no exact tool name approved by the MCP tool security control.
Keep the Toolbox narrow#
This module creates a new dedicated Toolbox. Set initialToolboxState to absent. Stop if a Toolbox with the chosen name already exists. That avoids adding a version to a Toolbox with unknown consumers or tools.
toolbox-version.json must contain one MCP object, one allowed_tools value, and require_approval: "always". Set expectedNamespacedTool to <server_label>.<allowed_tool_name>.
The approval value is metadata returned to the agent runtime. The runtime must still show the pending action and wait for a user decision. Do not treat the Toolbox endpoint itself as the approval enforcement point.
Keep credentials out of the files#
Configure authentication during the private-catalog flow or in the resulting Foundry project connection. Do not add API keys, bearer tokens, OAuth client secrets, or authorization headers to either JSON artifact.
Stop if the catalog flow cannot represent the approved authentication mode. Return the decision to the identity and security owners instead of storing a credential in the Toolbox payload.