Agent identity and scoped tools: one agent can act, the other can't

apiVersion: enterpriseagentgateway.solo.io/v1alpha1
kind: EnterpriseAgentgatewayPolicy
metadata:
  name: mcp-tool-authz
  namespace: mock-db
spec:
  targetRefs:
    - group: agentgateway.dev
      kind: AgentgatewayBackend
      name: mock-db-mcp
  backend:
    mcp:
      authorization:
        action: Allow
        policy:
          matchExpressions:
            # operators can call every tool (no tool-name restriction)
            - 'has(jwt.groups) && "db-operator" in jwt.groups'
            # readers get the read-only tools only
            - 'has(jwt.groups) && "db-reader" in jwt.groups &&
               mcp.tool.name in ["db_status","list_tables","db_query"]'

apiVersion: enterpriseagentgateway.solo.io/v1alpha1
kind: EnterpriseAgentgatewayPolicy
metadata:
  name: jwt-auth
  namespace: agentgateway-system
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: db-gateway
  traffic:
    jwtAuthentication:
      mode: Strict
      providers:
        - issuer: "http://keycloak.keycloak.svc.cluster.local/realms/solo"
          jwks:
            remote:
              jwksPath: "/realms/solo/protocol/openid-connect/certs"
              cacheDuration: "5m"
              backendRef:
                group: ""
                kind: Service
                name: keycloak
                namespace: keycloak
                port: 80

apiVersion: agentgateway.dev/v1alpha1
kind: AgentgatewayBackend
metadata:
  name: mock-db-mcp
  namespace: mock-db
spec:
  mcp:
    targets:
      - name: mock-db
        static:
          host: mock-db.mock-db.svc.cluster.local
          port: 8080
          path: /mcp
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: mock-db-route
  namespace: mock-db
spec:
  parentRefs:
    - { name: db-gateway, namespace: agentgateway-system }
  rules:
    - matches: [{ path: { type: PathPrefix, value: /mcp } }]
      backendRefs:
        - { group: agentgateway.dev, kind: AgentgatewayBackend, name: mock-db-mcp }

apiVersion: kagent.dev/v1alpha2
kind: RemoteMCPServer
metadata:
  name: db-mcp-reader
  namespace: kagent
spec:
  description: Mock orders database, reached with a read-only (db-reader) identity.
  url: http://db-gateway.agentgateway-system.svc.cluster.local:80/mcp
  protocol: STREAMABLE_HTTP
  headersFrom:
    - name: Authorization
      valueFrom: { type: Secret, name: agent-token-reader, key: authorization }
---
apiVersion: kagent.dev/v1alpha2
kind: RemoteMCPServer
metadata:
  name: db-mcp-operator
  namespace: kagent
spec:
  description: Mock orders database, reached with a privileged (db-operator) identity.
  url: http://db-gateway.agentgateway-system.svc.cluster.local:80/mcp
  protocol: STREAMABLE_HTTP
  headersFrom:
    - name: Authorization
      valueFrom: { type: Secret, name: agent-token-operator, key: authorization }

# read-only diagnoser — references the db-reader RemoteMCPServer
apiVersion: kagent.dev/v1alpha2
kind: Agent
metadata: { name: dba-diagnoser, namespace: kagent }
spec:
  type: Declarative
  declarative:
    modelConfig: default-model-config
    systemMessage: |
      You are a read-only database specialist for "orders". Inspect it, work out
      the root cause, and report root_cause, severity, fix, runbook_url. You do NOT
      have permission to change the database; name the privileged action the
      operator must take rather than attempting it.
    tools:
      - type: McpServer
        mcpServer: { apiGroup: kagent.dev, kind: RemoteMCPServer, name: db-mcp-reader,
                     toolNames: [db_status, list_tables, db_query] }
---
# privileged remediator — references the db-operator RemoteMCPServer
apiVersion: kagent.dev/v1alpha2
kind: Agent
metadata: { name: sre-remediator, namespace: kagent }
spec:
  type: Declarative
  declarative:
    modelConfig: default-model-config
    systemMessage: |
      You are the privileged on-call operator for "orders". If it is locked because
      the superuser password is not set, FIX it by calling db_reset_credentials with
      a strong password, then confirm it is healthy.
    tools:
      - type: McpServer
        mcpServer: { apiGroup: kagent.dev, kind: RemoteMCPServer, name: db-mcp-operator,
                     toolNames: [db_status, list_tables, db_query, db_reset_credentials] }

@mcp.tool()
def db_status() -> dict:
    """Report the orders database health: reachable, whether login works, status."""
    ...

@mcp.tool()
def list_tables() -> dict: ...
@mcp.tool()
def db_query(table: str, limit: int = 10) -> dict: ...

@mcp.tool()
def db_reset_credentials(new_password: str) -> dict:
    """Set the orders superuser password and unlock the database (privileged)."""
    db.locked = False
    return {"database": db.name, "status": "healthy",
            "message": "superuser password set; database unlocked"}

Before — db_status (as operator): the orders DB is locked
  "login": "FATAL: password authentication failed for user \"orders\" ...",
  "status": "degraded"

db-reader (dba-diagnoser) tries db_reset_credentials -> REFUSED
  "http_status": 400,
  "error": { "code": -32602, "message": "Unknown tool: db_reset_credentials" }

db-operator (sre-remediator) calls db_reset_credentials -> SUCCESS
  "status": "healthy",
  "message": "superuser password set; database unlocked and accepting logins"

After — db_status (as operator): the orders DB is healthy
  "login": "ok", "password_set": true, "status": "healthy"