Module scope 

Capability scoping — the granted MCP subset, interpreted as a Rule-of-Two trust budget. RFC 0012 §capability-scoping.

agentd has no policy engine; a subagent’s authority is the subset of MCP servers/tools its parent grants. Two invariants this module enforces:

1. Monotonic narrowing. A child’s scope is the intersection with its parent’s — a child can never widen beyond what its parent holds.
2. Rule of Two. Tools are tagged untrusted_input / sensitive / egress; granting one subagent all three legs of the lethal trifecta is refused unless explicitly overridden (--allow-trifecta).

This is pure logic; the trifecta check (check_trifecta) runs at the root grant in main.rs and scope narrowing runs at the subagent.spawn chokepoint in subagent/orchestrator.rs.

Structs

ToolScope

A subagent’s tool scope: which MCP servers it may reach, and (optionally) which tools within them. Both must pass for a call to be allowed.

Trifecta

The three legs of the “lethal trifecta”. A subagent holding all three — it reads untrusted content, can touch sensitive data, and can exfiltrate — is the dangerous combination (RFC 0012).

Enums

RuleOfTwo

The verdict on a grant. Ok ≤ 2 legs; all 3 legs → Refuse (or Warn with --allow-trifecta).

Scope

A whitelist over names: everything, or an explicit set. BTreeSet for deterministic ordering (stable logs/serialization).

TrifectaTag

One leg of the lethal trifecta — an operator-declared risk capability a tool carries (RFC 0012 §3.1). Tags come from MCP server config, never from model- or server-supplied metadata (§3.4: server metadata is untrusted).

TrifectaVerdict

The spawn-chokepoint verdict on a grant’s trifecta exposure (RFC 0012 §3.2). The variants name the observation the chokepoint emits — never a crash, always a tool result the parent’s model adapts to (RFC 0007):

Functions

check_trifecta

PURE Rule-of-Two check (RFC 0012 §3.2). Folds the tags of a granted tool set (OR across legs) and judges the accumulated budget:

evaluate

Evaluate a grant’s trifecta exposure. The Rule of Two is satisfied at ≤2 legs; 3 legs violates it — refused unless allow_trifecta downgrades the refusal to a loud warning (RFC 0012).