agent_tool_authorization_decided: from owned boundary to trusted query
Treat agent_tool_authorization_decided as a durable analytical contract: the owner emits one documented grain, a fixture proves the fields, and a reviewed query answers the stated question.
- 1
Outcome becomes final
Agent authorization or policy-enforcement layer emits only after policy evaluation is final and before the tool is allowed to execute.
- 2
Contract is bounded
12 required fields preserve the declared grain: One final authorization decision per logical tool-call attempt.
- 3
Fixture is verified
Check types, UTC time, alternate outcomes, idempotency, and every pseudonymous or review-classified field.
- 4
Question is answered
Which agent tool actions are allowed, denied, or routed to human approval?
Grain
One final authorization decision per logical tool-call attempt.
Owner
Agent authorization or policy-enforcement layer
Emit when
After policy evaluation is final and before the tool is allowed to execute.
Field contract
Typed fields with explicit privacy boundaries
Keep existing field names and types stable after production queries depend on them. Optional context should remain bounded, documented, and justified by a specific decision.
| Field | Type | Required | Privacy | Meaning |
|---|---|---|---|---|
| timestamp_utc | timestamp | yes | non-sensitive | UTC time at the outcome boundary. |
| event_id | string | yes | non-sensitive | Stable unique identifier used for deduplication. |
| release | string | yes | non-sensitive | Application or service version that emitted the event. |
| account_id | string | yes | pseudonymous | Stable internal account identifier, never an email or name. |
| run_id | string | yes | pseudonymous | Stable agent-run identifier shared with approved outcome events. |
| tool_call_id | string | yes | pseudonymous | Stable identifier for the logical tool-call attempt; never embed arguments. |
| workflow | string | yes | non-sensitive | Versioned, low-cardinality agent workflow. |
| tool_name | string | yes | non-sensitive | Approved low-cardinality tool identifier. |
| risk_level | string | yes | non-sensitive | Reviewed risk class such as low, medium, or high. |
| decision | string | yes | non-sensitive | Allowed, denied, or approval_required. |
| reason_code | string | yes | non-sensitive | Controlled policy reason; never a free-form model explanation. |
| policy_version | string | yes | non-sensitive | Version of the policy contract that made the decision. |
Synthetic JSON event
{
"timestamp_utc": "2026-07-30T16:24:12Z",
"event_id": "evt_agent_authz_01",
"account_id": "acct_8f31",
"release": "2026.07.4",
"run_id": "run_f28c",
"tool_call_id": "tool_call_a913",
"workflow": "support_resolution_v3",
"tool_name": "database_write",
"risk_level": "high",
"decision": "approval_required",
"reason_code": "external_state_change",
"policy_version": "agent-policy-12"
}Privacy review
Review identifiers before ingestion
This example uses synthetic identifiers. Pseudonymous values can still be personal data, and review fields can expose business or provider context. Apply your own consent, retention, access, residency, and deletion requirements.
account_id: pseudonymousrun_id: pseudonymoustool_call_id: pseudonymous
Validation checklist
Prove the contract before building a dashboard
- Send one known agent_tool_authorization_decided fixture after the documented outcome boundary.
- Verify all 12 required fields arrive with the documented types.
- Retry the same event identifier and confirm the chosen deduplication behavior.
- Send a controlled failure or alternate outcome when the workflow supports one.
- Run the related SQL over a fixed window and reconcile the result to the fixture.
Common mistakes
Keep one row equal to one durable outcome
- Emitting agent_tool_authorization_decided before agent authorization or policy-enforcement layer knows the final outcome.
- Mixing several grains in one table, which makes counts and rates ambiguous.
- Replacing controlled categories with raw URLs, payloads, prompts, or error text.
- Changing a field type in place after saved queries and dashboards depend on it.
- Adding identifiers without a documented investigation, access, and retention need.
Use the contract
Query and operationalize the event
Related contracts
Send a fixture before production traffic
Create a free API key, send the synthetic event, and inspect the inferred table before connecting a live workflow.