tool-execution-broker

Validate and broker USAP agent tool execution requests with authorization and scope checks.

3|3|Updated Mar 8, 2026

Search Tags:#authorization #access control #risk management #audit trail #security automation #tool execution

Ready to run

npx skills add https://github.com/jaskaranhundal/usap-skills --skill tool-execution-broker

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: tool-execution-broker
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/platform-ai/tool-execution-broker
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill tool-execution-broker

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill acts as a critical security gatekeeper, ensuring that automated tool executions are authorized, within scope, and logged, preventing unauthorized or risky actions.

Core Features & Use Cases

Authorization Validation: Verifies signed approvals and approver roles before execution.
Scope Enforcement: Ensures requested actions align with the target connector's permitted capabilities.
Audit Trail: Maintains a tamper-evident log of all authorized and blocked executions.
Use Case: When a security agent identifies a potential misconfiguration, this Skill validates the approval to remediate it, checks if the remediation action is allowed for the specific cloud resource, and logs the entire process before it's handed off for execution.

Quick Start

Use the tool-execution-broker skill to validate an execution request with recommendation ID 'abc-123'.

Frequently Asked Questions about tool-execution-broker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enforce authorization gates for automated security remediation actions?▼

Authorization gates for automated security remediation are enforced by validating signed approvals and approver roles before handing off execution requests to the MCP for infrastructure actions.

What is the best way to ensure automated tool executions stay within permitted cloud resource scopes?▼

Scope enforcement for automated tool executions is maintained by verifying that requested remediation actions align with the target connector's permitted capabilities before execution proceeds.

Do I need signed approval signatures before running security automation workflows against cloud environments?▼

Signed approval signatures are required as part of a robust validation checklist that also checks scope adherence and guardrail clearance before authorizing security automation workflows against cloud environments.

How does audit trail logging work for blocked or authorized automated infrastructure actions?▼

Audit trail logging for automated infrastructure actions maintains a tamper-evident record of both authorized and blocked executions, capturing the entire validation process for compliance tracking.

Can I use this tool execution broker with USAP agents to validate requests using a recommendation ID?▼

You can use the tool execution broker with USAP agents to validate execution requests by providing a recommendation ID to initiate the authorization and scope validation workflow.

When should I not use a security gatekeeper approach for automated cloud infrastructure actions?▼

A security gatekeeper approach for automated cloud infrastructure actions is unnecessary when manual oversight is already sufficient or when execution requests do not require approval signatures, scope validation, or audit trails.