Tool Allowlist — Basic

​

Policy JSON

{
  "registry": {
    "tools": ["web_search", "file_read", "database_query"],
    "deny_unlisted": true
  }
}

policy = {
    "registry": {
        "tools": ["web_search", "file_read", "database_query"],
        "deny_unlisted": True,
    }
}

​

What It Does

• Maintains an allowlist of 3 permitted tools
• Denies calls to any tool not on the list (e.g., file_write, shell_execute, email_send)
• Deny-by-default — unlisted tools are blocked, not monitored
• Prevents agents from performing unintended actions like writing files, sending emails, or executing commands

​

Example

{
  "action": "DENY",
  "risk_score": 0.85,
  "reasons": ["tool_not_in_allowlist"],
  "evidence": {
    "requested_tool": "shell_execute",
    "allowed_tools": ["web_search", "file_read", "database_query"],
    "deny_unlisted": true
  }
}

​

Install

# Install via CLI
tealtiger policy install tool-allowlist-basic

# Or copy the JSON above into your tealtiger.config.json

​

Customize

​

Related

• Model Allowlist — Control model access alongside tool access
• Provenance Verification — Verify tool and model integrity
• Customer Support Bot Starter — Includes a tailored tool allowlist
• TealRegistry Documentation — Full API reference