The breakwater connector ids an approved agent gate should grant: the single
provider-safe tool id the model called (== the connector id the write gate
checks; see the file header's provider-rewrite constraint). Requires
BOTH a non-empty toolName AND a non-empty toolCallId — a real
durable-agent gate always carries both (toolCallId is the suspend's
resumeLabel), so demanding both never rejects a real gate while narrowing
the surface where a workflow-step gate COINCIDENTALLY shaped {type:'approval', toolName} would mint an unintended grant. Returns [] otherwise, so a decision
never invents a grant the suspension did not request (fail-closed). The host
bridge prioritizes this exact identity over any co-present workflow
connectors array so ambiguity cannot widen a tool-call grant to suspension
scope.
The breakwater connector ids an approved agent gate should grant: the single provider-safe tool id the model called (== the connector id the write gate checks; see the file header's provider-rewrite constraint). Requires BOTH a non-empty
toolNameAND a non-emptytoolCallId— a real durable-agent gate always carries both (toolCallId is the suspend'sresumeLabel), so demanding both never rejects a real gate while narrowing the surface where a workflow-step gate COINCIDENTALLY shaped{type:'approval', toolName}would mint an unintended grant. Returns [] otherwise, so a decision never invents a grant the suspension did not request (fail-closed). The host bridge prioritizes this exact identity over any co-present workflowconnectorsarray so ambiguity cannot widen a tool-call grant to suspension scope.