Enum ToolOrigin 

pub enum ToolOrigin {
    LocalSandbox,
    Fetcher,
    FirstParty,
    AccessGrant,
    AccessRevoke,
    AdminManage,
    AdminGrant,
    RegisteredConnector,
    Unknown,
}

Where a tool comes from — the registry-provenance half of classification.

Trust scoping is the security-load-bearing part: taint-immune classification (Capability::FixedConnectorRead) is earned only by operator registration (ToolOrigin::RegisteredConnector / ToolOrigin::FirstParty) — never by a connector’s self-declared annotation hints alone. This is what the MCP specification normatively requires: clients MUST treat tool annotations as untrusted unless the server is trusted.

Variants

LocalSandbox

A process-local built-in, such as a coding tool. This origin describes local file authority. It does not prove operating-system network isolation. shell_exec can use routes allowed by the pod policy today; issue #2508 owns alignment with this taxonomy and D6’s route-removal checklist.

Fetcher

A built-in fetcher (the web/paid fetchers): brokered on the trusted side to a model-controlled destination.

FirstParty

A built-in that reads or acts on the caller’s own first-party state via the control plane (the history and wallet families): a fixed, operator-owned destination.

AccessGrant

A built-in that grants a third party access to the system itself — the admin invite (#700). Classified apart from Self::FirstParty because it requires Capability::GrantAccess, the never-granted marker, so it always escalates to a human before anything is minted: the agent can only ever PROPOSE an invite, never grant access on its own.

AccessRevoke

A built-in that removes a third party’s access to the system itself — the admin de-admission (#713), the offboarding sibling of Self::AccessGrant. Requires Capability::RevokeAccess, the never-granted marker, so it always escalates to a human before anything is removed: the agent can only ever PROPOSE a removal, never de-admit anyone on its own.

AdminManage

A built-in that takes away a persona’s ADMIN ROLE — the demote tool (#715), the sibling that completes the admin-management set alongside Self::AccessGrant/Self::AccessRevoke. Requires Capability::ManageAdmin, the never-granted marker, so it always escalates to a human before anyone’s admin role changes: the agent can only ever PROPOSE a demote, never remove anyone’s admin role on its own.

AdminGrant

A built-in that makes a persona an ADMIN — the promote tool (POLY-223), the admission-granting sibling that completes the admin-management set alongside Self::AccessGrant/ Self::AccessRevoke/Self::AdminManage. Requires Capability::GrantAdmin, the never-granted marker, so it always escalates to a human before anyone’s admin role changes: the agent can only ever PROPOSE a promotion, never grant the admin role on its own.

Classified apart from Self::AdminManage rather than sharing its capability marker: escalation_reason’s copy for that marker is directional (“would take away someone’s admin role”), which would misdescribe a promotion’s approval card, so the grant direction earns its own marker and its own wording.

RegisteredConnector

A connector tool whose server the operator registered (registry provenance, e.g. the ToolService registry). Its annotations are load-bearing inputs because the operator vouched for the server.

Unknown

Anything else: an unregistered server’s self-declared tool, an unknown name, an unannotated spec. Fails closed to the privileged set.

Trait Implementations

impl Clone for ToolOrigin

fn clone(&self) -> ToolOrigin

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ToolOrigin

impl Debug for ToolOrigin

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ToolOrigin

impl PartialEq for ToolOrigin

fn eq(&self, other: &ToolOrigin) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ToolOrigin