Q104: connector grants can narrow a toolkit to named actions and fixed argument values

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main/database/migrations/084-connector-grant-limits.ts

@@ -0,0 +1,7 @@
+export const connectorGrantLimitsSchema = `
+  alter table agent_connector_grants add column allowed_actions text;
+  alter table agent_connector_grants add column fixed_arguments text;
+
+  insert into schema_migrations(version, name, applied_at)
+  values (84, 'connector_grant_limits', datetime('now'));
+`;

src/main/database/schema.ts

@@ -82,6 +82,7 @@ import { runCapabilityWarningsSchema } from "./migrations/080-run-capability-war
 import { connectorExecutionsSchema } from "./migrations/081-connector-executions";
 import { connectorPendingAccountSchema } from "./migrations/082-connector-pending-account";
 import { connectorAccountLabelsSchema } from "./migrations/083-connector-account-labels";
+import { connectorGrantLimitsSchema } from "./migrations/084-connector-grant-limits";
 
 interface Migration {
   version: number;
@@ -173,6 +174,7 @@ const MIGRATIONS: Migration[] = [
   { version: 81, name: "connector_executions", sql: connectorExecutionsSchema },
   { version: 82, name: "connector_pending_account", sql: connectorPendingAccountSchema },
   { version: 83, name: "connector_account_labels", sql: connectorAccountLabelsSchema },
+  { version: 84, name: "connector_grant_limits", sql: connectorGrantLimitsSchema },
 ];
 
 const SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;

src/main/services/agent-connector-tools.ts

@@ -1,6 +1,6 @@
-import { requireString } from "./agent-tool-args";
+import { optionalStringArray, requireString } from "./agent-tool-args";
 import type { AgentToolContext, AgentToolDeps } from "./agent-tools";
-import { ConnectorGrantsService } from "./composio/connector-grants";
+import { ConnectorGrantsService, type ConnectorGrantLimits } from "./composio/connector-grants";
 import type { JsonRecord } from "./provider-http";
 
 /** Company connector visibility for any agent: what is connected, who holds it. */
@@ -18,8 +18,7 @@ export function listConnectorsTool(deps: AgentToolDeps, ctx: AgentToolContext):
   const lines = accounts.map((account) => {
     const holders = grants
       .filter((grant) => grant.toolkitSlug === account.toolkitSlug && grant.accountLabel === account.label)
-      .map((grant) => agentNames.get(grant.agentId))
-      .filter(Boolean);
+      .map((grant) => `${agentNames.get(grant.agentId)}${limitNote(grant.limits)}`);
     return `- ${account.toolkitName} (${account.toolkitSlug}), account "${account.label}": ${holders.length > 0 ? `granted to ${holders.join(", ")}` : "no grants yet"}`;
   });
   return ["Connected toolkits:", ...lines].join("\n");
@@ -45,11 +44,38 @@ export function grantConnectorTool(deps: AgentToolDeps, ctx: AgentToolContext, a
       agentId: target.id,
       toolkitSlug: toolkit,
       accountLabel: args.account === undefined ? null : requireString(args.account, "account"),
+      limits: {
+        actions: args.actions === undefined ? null : optionalStringArray(args.actions, "actions"),
+        fixedArguments: args.fixed_arguments === undefined ? null : requireObject(args.fixed_arguments, "fixed_arguments"),
+      },
       grantedByType: "agent",
       grantedById: ctx.agent.id,
     });
-    return `${target.name} now has access to the ${toolkit.toLowerCase()} connector through its "${label}" account; its tools join their next run.`;
+    return `${target.name} now has access to the ${toolkit.toLowerCase()} connector through its "${label}" account${limitText(args)}; its tools join their next run.`;
   }
   grantsService.revoke({ orgId: ctx.orgId, agentId: target.id, toolkitSlug: toolkit });
   return `${target.name} no longer has access to the ${toolkit.toLowerCase()} connector.`;
 }
+
+function requireObject(value: unknown, field: string): Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value) || Object.keys(value).length === 0) {
+    throw new Error(`"${field}" must be an object of argument values.`);
+  }
+  return value as Record<string, unknown>;
+}
+
+function limitText(args: JsonRecord): string {
+  return limitNote({
+    actions: Array.isArray(args.actions) ? args.actions.map((action) => String(action).trim().toUpperCase()) : null,
+    fixedArguments: args.fixed_arguments === undefined ? null : args.fixed_arguments as Record<string, unknown>,
+  });
+}
+
+/** A grant's limits in a few words, empty when it has none. */
+function limitNote(limits: ConnectorGrantLimits): string {
+  const parts = [
+    ...(limits.actions ? [`only ${limits.actions.join(", ")}`] : []),
+    ...(limits.fixedArguments ? [`limited to ${JSON.stringify(limits.fixedArguments)}`] : []),
+  ];
+  return parts.length > 0 ? ` (${parts.join("; ")})` : "";
+}

src/main/services/agent-tools.ts

@@ -189,6 +189,8 @@ export const AGENT_TOOLS: ToolDefinition[] = [
         agent_name: { type: "string", description: "The teammate receiving access." },
         toolkit: { type: "string", description: "Connected toolkit slug, e.g. 'github'." },
         account: { type: "string", description: "Which of the toolkit's accounts, by label (see list_connectors); required when it has several." },
+        actions: { type: "array", items: { type: "string" }, description: "Only these exact action names, e.g. read-only actions; omit to allow every action." },
+        fixed_arguments: { type: "object", description: "Argument values every action must take, e.g. {\"repo\": \"site\"}; actions without these arguments are refused." },
       },
       required: ["agent_name", "toolkit"],
     },

src/main/services/composio/composio-tool-bridge.ts

@@ -3,7 +3,7 @@ import type { ToolDefinition, ToolCall } from "../provider-tool-turn";
 import { ComposioClient, ComposioHttpError, type ComposioToolExecutionResult, type ComposioToolSchema } from "./composio-client";
 import { beginConnectorExecution, settleConnectorExecution } from "./connector-executions";
 import type { IntegrationKeyStore } from "../integration-key-store";
-import { ConnectorGrantsService } from "./connector-grants";
+import { ConnectorGrantsService, grantAllowsAction, grantLimitRefusal } from "./connector-grants";
 import { currentRunId } from "../run-control";
 
 const COMPOSIO_TOOL_PREFIX = "composio_";
@@ -70,7 +70,7 @@ export async function executeComposioTool(
   const toolkits = new ConnectorGrantsService(db).toolkitsForAgent(orgId, agentId);
   if (toolkits.length === 0) return "ERROR: You hold no connector grants. Ask the CEO to grant you one (grant_connector).";
   try {
-    if (call.name === FIND_ACTIONS_TOOL) return await findActions(db, apiKey, toolkits, call.arguments);
+    if (call.name === FIND_ACTIONS_TOOL) return await findActions(db, apiKey, orgId, agentId, toolkits, call.arguments);
     if (call.name === RUN_ACTION_TOOL) return await runAction(db, apiKey, orgId, agentId, toolkits, call.arguments);
     return `ERROR: ${call.name} is not a connector tool; use ${FIND_ACTIONS_TOOL} and ${RUN_ACTION_TOOL}.`;
   } catch (error) {
@@ -78,12 +78,19 @@ export async function executeComposioTool(
   }
 }
 
-async function findActions(db: DatabaseSync, apiKey: string, toolkits: string[], args: Record<string, unknown>): Promise<string> {
+async function findActions(db: DatabaseSync, apiKey: string, orgId: string, agentId: string, toolkits: string[], args: Record<string, unknown>): Promise<string> {
   const query = typeof args.query === "string" ? args.query.trim().toLowerCase() : "";
   if (!query) return "ERROR: query is required: say in a few words what you want to do.";
   const toolkit = typeof args.toolkit === "string" ? args.toolkit.toLowerCase() : null;
   if (toolkit && !toolkits.includes(toolkit)) return `ERROR: You hold no grant for "${toolkit}". Your services: ${toolkits.join(", ")}.`;
-  const actions = (await actionCatalog(db, apiKey, toolkits)).filter((action) => !toolkit || action.toolkitSlug?.toLowerCase() === toolkit);
+  const grants = new ConnectorGrantsService(db);
+  const limits = new Map(toolkits.map((slug) => [slug, grants.limitsForAgent(orgId, agentId, slug)]));
+  // Actions a grant does not allow are not shown at all.
+  const actions = (await actionCatalog(db, apiKey, toolkits)).filter((action) => {
+    const slug = action.toolkitSlug?.toLowerCase();
+    const allowed = slug ? limits.get(slug) : undefined;
+    return (!toolkit || slug === toolkit) && allowed !== undefined && grantAllowsAction(allowed, action.name);
+  });
   const words = query.split(/[^a-z0-9]+/).filter(Boolean);
   const scored = actions
     .map((action) => {
@@ -111,9 +118,12 @@ async function runAction(db: DatabaseSync, apiKey: string, orgId: string, agentI
     return `ERROR: You have no grant for the "${toolkit}" connector. Ask the CEO to grant it to you (grant_connector).`;
   }
   if (args.account !== undefined && typeof args.account !== "string") return "ERROR: account must be the label of one of the service's accounts.";
-  const account = new ConnectorGrantsService(db).accountForAgent(orgId, agentId, toolkit, args.account ?? null);
+  const grants = new ConnectorGrantsService(db);
+  const account = grants.accountForAgent(orgId, agentId, toolkit, args.account ?? null);
   const input = typeof args.arguments === "object" && args.arguments !== null && !Array.isArray(args.arguments) ? args.arguments as Record<string, unknown> : null;
   if (!input) return "ERROR: arguments must be an object matching the action's input.";
+  const refusal = grantLimitRefusal(grants.limitsForAgent(orgId, agentId, toolkit), toolkit, action, input);
+  if (refusal) return `ERROR: ${refusal}`;
   if (args.confirm_not_done !== undefined && typeof args.confirm_not_done !== "boolean") return "ERROR: confirm_not_done must be true or false.";
   const started = beginConnectorExecution(db, { orgId, agentId, runId: currentRunId(), action: action.name, accountLabel: account.label, args: input, confirmedNotDone: args.confirm_not_done === true });
   if ("blockedBy" in started) {

src/main/services/composio/connector-grants.ts

@@ -1,6 +1,7 @@
 import type { DatabaseSync } from "node:sqlite";
 import { DEFAULT_CONNECTOR_ACCOUNT_LABEL } from "../../../shared/commands/composio";
 import { createId } from "../../../shared/ids";
+import { canonicalJson } from "./connector-executions";
 
 export const DEFAULT_ACCOUNT_LABEL = DEFAULT_CONNECTOR_ACCOUNT_LABEL;
 const MAX_LABEL_CHARS = 40;
@@ -20,26 +21,39 @@ export interface ConnectorGrantRow {
   agentId: string;
   toolkitSlug: string;
   accountLabel: string;
+  limits: ConnectorGrantLimits;
 }
 
+/** What a grant narrows the toolkit to: only these actions, and these argument values on every call; null means no limit. */
+export interface ConnectorGrantLimits {
+  actions: string[] | null;
+  fixedArguments: Record<string, unknown> | null;
+}
+
+const NO_LIMITS: ConnectorGrantLimits = { actions: null, fixedArguments: null };
+
 /** Which agents may use which labelled company accounts: the CEO all active ones by role, others one per toolkit by grant. */
 export class ConnectorGrantsService {
   constructor(private readonly db: DatabaseSync) {}
 
-  grant(input: { orgId: string; agentId: string; toolkitSlug: string; accountLabel: string | null; grantedByType: "agent" | "employee"; grantedById: string | null }): string {
+  grant(input: { orgId: string; agentId: string; toolkitSlug: string; accountLabel: string | null; limits: ConnectorGrantLimits; grantedByType: "agent" | "employee"; grantedById: string | null }): string {
     const agent = this.db.prepare("select id from agents where id = ? and org_id = ? and lifecycle = 'active'")
       .get(input.agentId, input.orgId);
     if (!agent) throw new Error("Grant target must be an active agent in this organization.");
     const slug = normalizeSlug(input.toolkitSlug);
     const label = this.chooseAccount(input.orgId, slug, input.accountLabel).label;
+    const actions = input.limits.actions === null ? null : JSON.stringify(normalizeActionNames(input.limits.actions));
+    const fixed = input.limits.fixedArguments === null ? null : JSON.stringify(input.limits.fixedArguments);
     this.db.prepare(`
-      insert into agent_connector_grants(id, org_id, agent_id, toolkit_slug, account_label, granted_by_type, granted_by_id, created_at)
-      values (?, ?, ?, ?, ?, ?, ?, ?)
+      insert into agent_connector_grants(id, org_id, agent_id, toolkit_slug, account_label, allowed_actions, fixed_arguments, granted_by_type, granted_by_id, created_at)
+      values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       on conflict(org_id, agent_id, toolkit_slug) do update set
         account_label = excluded.account_label,
+        allowed_actions = excluded.allowed_actions,
+        fixed_arguments = excluded.fixed_arguments,
         granted_by_type = excluded.granted_by_type,
         granted_by_id = excluded.granted_by_id
-    `).run(createId("cgr"), input.orgId, input.agentId, slug, label, input.grantedByType, input.grantedById, new Date().toISOString());
+    `).run(createId("cgr"), input.orgId, input.agentId, slug, label, actions, fixed, input.grantedByType, input.grantedById, new Date().toISOString());
     return label;
   }
 
@@ -78,6 +92,15 @@ export class ConnectorGrantsService {
     return account;
   }
 
+  /** The limits this agent works under on a toolkit; the CEO has none. */
+  limitsForAgent(orgId: string, agentId: string, toolkitSlug: string): ConnectorGrantLimits {
+    if (this.isCeo(orgId, agentId)) return NO_LIMITS;
+    const row = this.db.prepare("select allowed_actions, fixed_arguments from agent_connector_grants where org_id = ? and agent_id = ? and toolkit_slug = ?")
+      .get(orgId, agentId, normalizeSlug(toolkitSlug)) as { allowed_actions: string | null; fixed_arguments: string | null } | undefined;
+    if (!row) throw new Error(`You have no grant for the "${toolkitSlug}" connector. Ask the CEO to grant it to you (grant_connector).`);
+    return parseLimits(row.allowed_actions, row.fixed_arguments);
+  }
+
   activeAccounts(orgId: string): ConnectorAccountRow[] {
     const rows = this.db.prepare(`
       select id, org_id, toolkit_slug, toolkit_name, label, status
@@ -97,12 +120,19 @@ export class ConnectorGrantsService {
 
   grantsForOrg(orgId: string): ConnectorGrantRow[] {
     const rows = this.db.prepare(`
-      select id, org_id, agent_id, toolkit_slug, account_label
+      select id, org_id, agent_id, toolkit_slug, account_label, allowed_actions, fixed_arguments
       from agent_connector_grants
       where org_id = ?
       order by toolkit_slug asc
-    `).all(orgId) as Array<{ id: string; org_id: string; agent_id: string; toolkit_slug: string; account_label: string }>;
-    return rows.map((row) => ({ id: row.id, orgId: row.org_id, agentId: row.agent_id, toolkitSlug: row.toolkit_slug, accountLabel: row.account_label }));
+    `).all(orgId) as Array<{ id: string; org_id: string; agent_id: string; toolkit_slug: string; account_label: string; allowed_actions: string | null; fixed_arguments: string | null }>;
+    return rows.map((row) => ({
+      id: row.id,
+      orgId: row.org_id,
+      agentId: row.agent_id,
+      toolkitSlug: row.toolkit_slug,
+      accountLabel: row.account_label,
+      limits: parseLimits(row.allowed_actions, row.fixed_arguments),
+    }));
   }
 
   /** The named active account of a toolkit, or its only one; several accounts with no name is an error that lists them. */
@@ -133,6 +163,46 @@ export function normalizeSlug(slug: string): string {
   return normalized;
 }
 
+/** Why a call breaks a grant's limits, or null when it keeps them; an action that cannot take a fixed argument could reach past it, so it is refused. */
+export function grantLimitRefusal(
+  limits: ConnectorGrantLimits,
+  toolkit: string,
+  action: { name: string; parameters: Record<string, unknown> },
+  input: Record<string, unknown>,
+): string | null {
+  const name = action.name.toUpperCase();
+  if (limits.actions && !limits.actions.includes(name)) {
+    return `Your grant for ${toolkit} allows only ${limits.actions.join(", ")}; ${name} is not among them.`;
+  }
+  const properties = (action.parameters.properties ?? {}) as Record<string, unknown>;
+  for (const [key, value] of Object.entries(limits.fixedArguments ?? {})) {
+    if (!Object.hasOwn(properties, key)) return `Your grant for ${toolkit} is limited to ${key}=${JSON.stringify(value)}, and ${name} takes no ${key}.`;
+    if (!Object.hasOwn(input, key)) return `Your grant for ${toolkit} is limited to ${key}=${JSON.stringify(value)}; pass ${key} with that value.`;
+    if (canonicalJson(input[key]) !== canonicalJson(value)) {
+      return `Your grant for ${toolkit} is limited to ${key}=${JSON.stringify(value)}; this call has ${key}=${JSON.stringify(input[key])}.`;
+    }
+  }
+  return null;
+}
+
+/** Whether a grant's action list lets an agent see an action at all. */
+export function grantAllowsAction(limits: ConnectorGrantLimits, actionName: string): boolean {
+  return limits.actions === null || limits.actions.includes(actionName.toUpperCase());
+}
+
+function normalizeActionNames(actions: string[]): string[] {
+  const names = actions.map((action) => action.trim().toUpperCase());
+  if (names.length === 0 || names.some((name) => !name)) throw new Error("actions must name at least one action, none blank.");
+  return [...new Set(names)];
+}
+
+function parseLimits(actions: string | null, fixedArguments: string | null): ConnectorGrantLimits {
+  return {
+    actions: actions === null ? null : JSON.parse(actions) as string[],
+    fixedArguments: fixedArguments === null ? null : JSON.parse(fixedArguments) as Record<string, unknown>,
+  };
+}
+
 /** Account labels are trimmed and lower-case so "Sales" and "sales " name the same account. */
 export function normalizeAccountLabel(label: string): string {
   const normalized = label.trim().toLowerCase();

src/renderer/src/i18n/zh.ts

@@ -386,6 +386,7 @@ export const zh: Record<string, string> = {
   "Service": "服务",
   "Account label, e.g. sales": "账号标签，例如 sales",
   "Add account": "添加账号",
+  "limited": "受限",
   "Refresh models": "刷新模型",
   "Region": "区域",
   "Rejected": "已驳回",

src/renderer/src/pages/connectors/ConnectedList.tsx

@@ -56,8 +56,10 @@ export function ConnectedList({
         {accounts.map((account) => {
           const holders = grants
             .filter((grant) => grant.toolkitSlug === account.toolkitSlug && grant.accountLabel === account.label)
-            .map((grant) => agentNames.get(grant.agentId))
-            .filter((name): name is string => Boolean(name));
+            .flatMap((grant) => {
+              const name = agentNames.get(grant.agentId);
+              return name ? [grant.allowedActions || grant.fixedArguments ? `${name} · ${t("limited")}` : name] : [];
+            });
           const busy = busySlug !== null;
           return (
             <div key={account.id} style={{ border: "1px solid var(--border)", borderRadius: 12, padding: 14, background: "var(--panel)" }}>

src/shared/domain.ts

@@ -467,6 +467,10 @@ export interface ConnectorGrantRecord {
   agentId: string;
   toolkitSlug: string;
   accountLabel: string;
+  /** JSON array of the only action names this grant allows; null allows every action. */
+  allowedActions: string | null;
+  /** JSON object of argument values every action under this grant must take; null fixes none. */
+  fixedArguments: string | null;
   grantedByType: string;
   grantedById: string | null;
   createdAt: string;

tests/unit/agent-instructions.test.ts

@@ -158,7 +158,7 @@ describe("agent instruction wiring", () => {
         values ('ca_github', ?, 'github', 'GitHub', 'main', 'ac_github', 'ACTIVE', ?, ?)
       `).run(orgId, now, now);
       new ConnectorGrantsService(connection.db).grant({
-        orgId, agentId, toolkitSlug: "github", accountLabel: null, grantedByType: "employee", grantedById: null,
+        orgId, agentId, toolkitSlug: "github", accountLabel: null, limits: { actions: null, fixedArguments: null }, grantedByType: "employee", grantedById: null,
       });
       taskId = organization.createTask({
         orgId, title: "Ship it", description: "d", status: TASK_STATUS.IN_PROGRESS,

tests/unit/composio-reconnect.test.ts

@@ -58,7 +58,7 @@ async function connectedCompany() {
   const first = await service.connectToolkit(orgId, "github", "main");
   remote.get(first.accountId)!.status = "ACTIVE";
   await service.refreshAccounts(orgId);
-  new ConnectorGrantsService(connection.db).grant({ orgId, agentId: ceoId, toolkitSlug: "github", accountLabel: null, grantedByType: "agent", grantedById: ceoId });
+  new ConnectorGrantsService(connection.db).grant({ orgId, agentId: ceoId, toolkitSlug: "github", accountLabel: null, limits: { actions: null, fixedArguments: null }, grantedByType: "agent", grantedById: ceoId });
   const account = () => connection.db.prepare("select id, status, pending_account_id as pending from connector_accounts where org_id = ?").get(orgId) as { id: string; status: string; pending: string | null };
   const grants = () => (connection.db.prepare("select count(*) as n from agent_connector_grants where org_id = ?").get(orgId) as { n: number }).n;
   return { connection, orgId, service, oldId: first.accountId, account, grants };

tests/unit/composio-tool-pages.test.ts

@@ -175,13 +175,42 @@ describe("agents reach every action through search and run", () => {
     h.connection.close();
   });
 
+  test("a grant limited to some actions and one resource shows and runs only those", async () => {
+    const withRepo = (slug: string, description: string) => ({ slug, name: slug, description, input_parameters: { type: "object", properties: { repo: { type: "string" } } }, toolkit: { slug: "github" } });
+    pages.set("github:", { items: [withRepo("GITHUB_LIST_ISSUES", "list issues"), withRepo("GITHUB_CREATE_ISSUE", "create issue"), tool("GITHUB_LIST_ALL_REPOS")], next_cursor: null });
+    const h = company("ak_limits");
+    const staff = h.connection.transaction(() => {
+      const providerId = (h.connection.db.prepare("select id from providers where org_id = ? and provider_key = 'openai'").get(h.orgId) as { id: string }).id;
+      const id = new OrganizationService(h.connection.db).createAgent({ orgId: h.orgId, name: "Ada", role: "Engineer", department: "Engineering", modelProviderId: providerId, modelId: "gpt-5.4", budgetCents: 1000, managerAgentId: h.ceoId });
+      new ConnectorGrantsService(h.connection.db).grant({ orgId: h.orgId, agentId: id, toolkitSlug: "github", accountLabel: null, limits: { actions: ["github_list_issues", "GITHUB_LIST_ALL_REPOS"], fixedArguments: { repo: "site" } }, grantedByType: "agent", grantedById: h.ceoId });
+      return id;
+    });
+    const asAda = (name: string, args: Record<string, unknown>) => executeComposioTool(h.connection.db, h.keys, h.orgId, staff, { id: "c9", name, arguments: args });
+    const found = JSON.parse(await asAda("composio_find_actions", { query: "issue" })) as { matches: Array<{ action: string }> };
+    expect(found.matches.map((match) => match.action)).toEqual(["GITHUB_LIST_ISSUES"]);
+    expect(await asAda("composio_run_action", { action: "GITHUB_CREATE_ISSUE", arguments: { repo: "site" } }))
+      .toBe("ERROR: Your grant for github allows only GITHUB_LIST_ISSUES, GITHUB_LIST_ALL_REPOS; GITHUB_CREATE_ISSUE is not among them.");
+    expect(await asAda("composio_run_action", { action: "GITHUB_LIST_ISSUES", arguments: { repo: "secret" } }))
+      .toBe('ERROR: Your grant for github is limited to repo="site"; this call has repo="secret".');
+    expect(await asAda("composio_run_action", { action: "GITHUB_LIST_ISSUES", arguments: {} }))
+      .toBe('ERROR: Your grant for github is limited to repo="site"; pass repo with that value.');
+    expect(await asAda("composio_run_action", { action: "GITHUB_LIST_ALL_REPOS", arguments: {} }))
+      .toBe('ERROR: Your grant for github is limited to repo="site", and GITHUB_LIST_ALL_REPOS takes no repo.');
+    const sent = written.length;
+    expect(await asAda("composio_run_action", { action: "GITHUB_LIST_ISSUES", arguments: { repo: "site" } })).toBe(JSON.stringify({ number: 42 }));
+    expect(written.length).toBe(sent + 1);
+    // The CEO holds every action by role.
+    expect(await h.call("composio_run_action", { action: "GITHUB_CREATE_ISSUE", arguments: { repo: "other" } })).toBe(JSON.stringify({ number: 42 }));
+    h.connection.close();
+  });
+
   test("a grant revoked while the catalog loads stops the action, and a search is not journaled as work", async () => {
     pages.set("github:", { items: [tool("GITHUB_STAR_A_REPOSITORY")], next_cursor: null });
     const h = company("ak_revoke");
     const staff = h.connection.transaction(() => {
       const providerId = (h.connection.db.prepare("select id from providers where org_id = ? and provider_key = 'openai'").get(h.orgId) as { id: string }).id;
       const id = new OrganizationService(h.connection.db).createAgent({ orgId: h.orgId, name: "Ada", role: "Engineer", department: "Engineering", modelProviderId: providerId, modelId: "gpt-5.4", budgetCents: 1000, managerAgentId: h.ceoId });
-      new ConnectorGrantsService(h.connection.db).grant({ orgId: h.orgId, agentId: id, toolkitSlug: "github", accountLabel: null, grantedByType: "agent", grantedById: h.ceoId });
+      new ConnectorGrantsService(h.connection.db).grant({ orgId: h.orgId, agentId: id, toolkitSlug: "github", accountLabel: null, limits: { actions: null, fixedArguments: null }, grantedByType: "agent", grantedById: h.ceoId });
       return id;
     });
     const running = executeComposioTool(h.connection.db, h.keys, h.orgId, staff, { id: "c2", name: "composio_run_action", arguments: { action: "GITHUB_STAR_A_REPOSITORY", arguments: {} } });

tests/unit/connector-grants.test.ts

@@ -5,7 +5,7 @@ import { describe, expect, test } from "vitest";
 import { DatabaseConnection } from "../../src/main/database/connection";
 import { OrganizationService } from "../../src/main/services/organization-service";
 import { ChatService } from "../../src/main/services/chat-service";
-import { ConnectorGrantsService } from "../../src/main/services/composio/connector-grants";
+import { ConnectorGrantsService, grantLimitRefusal } from "../../src/main/services/composio/connector-grants";
 import { dispatchAgentTool, type AgentToolContext } from "../../src/main/services/agent-tools";
 
 function call(name: string, args: Record<string, unknown>) {
@@ -71,7 +71,7 @@ describe("connector grants", () => {
     const h = harness();
     const grants = new ConnectorGrantsService(h.connection.db);
     expect(() => grants.grant({
-      orgId: h.orgId, agentId: h.danaId, toolkitSlug: "github", accountLabel: null, grantedByType: "employee", grantedById: null,
+      orgId: h.orgId, agentId: h.danaId, toolkitSlug: "github", accountLabel: null, limits: { actions: null, fixedArguments: null }, grantedByType: "employee", grantedById: null,
     })).toThrow(/No active connection/);
   });
 
@@ -122,6 +122,29 @@ describe("connector grants", () => {
     expect(grants.toolkitsForAgent(h.orgId, h.ceoId)).toEqual(["github"]);
   });
 
+  test("the CEO grants a toolkit narrowed to some actions and argument values", () => {
+    const h = harness();
+    connectToolkit(h, "gmail", "Gmail");
+    expect(dispatchAgentTool(h.deps, h.ceoCtx, call("grant_connector", { agent_name: "Dana", toolkit: "gmail", actions: ["gmail_fetch_emails"], fixed_arguments: { label: "support" } })))
+      .toContain('through its "main" account (only GMAIL_FETCH_EMAILS; limited to {"label":"support"})');
+    expect(dispatchAgentTool(h.deps, h.danaCtx, call("list_connectors", {})))
+      .toContain('Gmail (gmail), account "main": granted to Dana (only GMAIL_FETCH_EMAILS; limited to {"label":"support"})');
+    expect(new ConnectorGrantsService(h.connection.db).limitsForAgent(h.orgId, h.danaId, "gmail")).toEqual({ actions: ["GMAIL_FETCH_EMAILS"], fixedArguments: { label: "support" } });
+    expect(dispatchAgentTool(h.deps, h.ceoCtx, call("grant_connector", { agent_name: "Dana", toolkit: "gmail", actions: [] })))
+      .toBe("ERROR: actions must name at least one action, none blank.");
+    expect(dispatchAgentTool(h.deps, h.ceoCtx, call("grant_connector", { agent_name: "Dana", toolkit: "gmail", fixed_arguments: ["label"] })))
+      .toBe('ERROR: "fixed_arguments" must be an object of argument values.');
+    const nullRepo = { actions: null, fixedArguments: { repo: null } };
+    const action = { name: "GITHUB_LIST_ISSUES", parameters: { properties: { repo: {} } } };
+    expect(grantLimitRefusal(nullRepo, "github", action, {})).toBe("Your grant for github is limited to repo=null; pass repo with that value.");
+    expect(grantLimitRefusal(nullRepo, "github", action, { repo: null })).toBeNull();
+    const proto = { actions: null, fixedArguments: JSON.parse('{"__proto__": {}}') as Record<string, unknown> };
+    expect(grantLimitRefusal(proto, "github", action, {})).toBe("Your grant for github is limited to __proto__={}, and GITHUB_LIST_ISSUES takes no __proto__.");
+    // A grant without limits replaces a limited one.
+    dispatchAgentTool(h.deps, h.ceoCtx, call("grant_connector", { agent_name: "Dana", toolkit: "gmail" }));
+    expect(new ConnectorGrantsService(h.connection.db).limitsForAgent(h.orgId, h.danaId, "gmail")).toEqual({ actions: null, fixedArguments: null });
+  });
+
   test("staff cannot hand out connector access", () => {
     const h = harness();
     connectToolkit(h, "github", "GitHub");
@@ -134,7 +157,7 @@ describe("connector grants", () => {
     const h = harness();
     connectToolkit(h, "slack", "Slack");
     const grants = new ConnectorGrantsService(h.connection.db);
-    grants.grant({ orgId: h.orgId, agentId: h.danaId, toolkitSlug: "slack", accountLabel: null, grantedByType: "employee", grantedById: null });
+    grants.grant({ orgId: h.orgId, agentId: h.danaId, toolkitSlug: "slack", accountLabel: null, limits: { actions: null, fixedArguments: null }, grantedByType: "employee", grantedById: null });
     expect(grants.toolkitsForAgent(h.orgId, h.danaId)).toEqual(["slack"]);
     h.connection.db.prepare("update connector_accounts set status = 'EXPIRED' where org_id = ? and toolkit_slug = 'slack'").run(h.orgId);
     expect(grants.toolkitsForAgent(h.orgId, h.danaId)).toEqual([]);

tests/unit/domain-services.test.ts

@@ -24,7 +24,7 @@ describe("domain services", () => {
     const connection = createConnection();
 
     const rows = connection.db.prepare("select version from schema_migrations order by version asc").all() as Array<{ version: number }>;
-    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83]);
+    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84]);
     connection.close();
   });