mcp_kit

defmodule MCPKit.Policy do
  @moduledoc """
  Host-owned authorization boundary for MCP surfaces.

  Policy is evaluated on every request. Router declarations define the superset
  of available capabilities, while policy determines which items are visible or
  invokable for the current session and request parameters.
  """

  @type decision :: :allow | {:deny, :not_found | :forbidden}

  @doc """
  Authorizes a request-time MCP action.

  The action identifies the surface being accessed, such as a tool call, prompt
  completion, or resource read. The context map includes the current session,
  request parameters, normalized arguments, and host definition module.
  """
  @callback authorize(action :: term(), context :: map()) :: decision()
end