The JSON vCon - Tool Invocation Extension

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 6 May 2027.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

This document adds Event Object types for recording the policy decisions of AI agents and their invocation of tools to the JSON [JSON] vCon schema defined in [VCON-CORE]. The general framework and requirements for defining an extension to the JSON vCon schema are defined in [VCON-CORE].¶

AI agents converse with people and other agents, and perform operations on their behalf (e.g. invoking tools). The conversation between an agent and a person or another agent is captured with Dialog Objects in [VCON-CORE]. The use of a tool by an agent is not dialog. It is a request to the tool and one or more responses from it, which are captured in this document as Event Objects. This fills the gap for tool invocations and results identified in [ROADMAP], and covers the agent view of an Action Record in [AUDIT-ARCH].¶

Before an agent performs an operation (e.g. invoking a tool), the agent or its host decides by policy whether the operation may be performed. The decision is that no permission is needed, that permission is required or that the operation is disallowed. No one is asked, so there is no conversation, only the decision and what it applies to.¶

The policy decision is defined in this document because the invocation of a tool is the most common operation it applies to, and the decision is part of the life cycle of a tool invocation. Its outcome determines whether the tool is invoked, and it identifies the tool by the same parameters as the invocation. Without it, a use of a tool which was disallowed, or for which permission was not granted, would leave no record. The decision is defined so that it can also apply to other operations (e.g. delegating to another agent).¶

This document defines a state model for the policy decision (see Section 4) and a state model for a tool invocation (see Section 5), with an Event Object type for each transition in them. The Event Object types are not specific to any one protocol. The Model Context Protocol [MCP] is used as the first example, and a mapping to it is given in Appendix A. The word "invocation" is used rather than "call", as "call" in vCon commonly implies a telephone call.¶

Requests for permission or direction made to the person or agent on whose behalf the agent is acting, and their responses, are not defined in this document. They are part of the conversation, and occur outside tool invocations as well as within them (e.g. a clarifying choice put to a person, approval to delegate to another agent, and in contact centers, consent to record and IVR menu choices). Event Object types for them need to be defined in a future document. The requirements identified so far are outlined in Section 7.¶

The following are also not in the scope of this document:¶

• The definition of tools and of the tools available to an agent. This document assumes that tools are defined elsewhere and only records their use.¶

• Making or enforcing the policy decision. Only the decision is recorded.¶

• The record of the invocation kept by the tool or its provider. This is another observation point, which may be captured in the same vCon, in a separate vCon or in a log (see [ROADMAP]).¶

• The protocol used to invoke the tool. Only the data exchanged and the outcome of the invocation are captured.¶

2. Conventions and Definitions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

3. Extension Name

The extension name for this document is "tool-invocation".¶

A vCon that contains any of the Event Object types defined in this document SHOULD include "tool-invocation" in the extensions parameter. "tool-invocation" is not required in the critical parameter (see Section 8).¶

TODO: revisit whether "tool-invocation" is required in the critical parameter, pending Section 9.¶

4. Policy Decision State Model

Before an operation is performed, the agent or its host makes a policy decision whether it may be performed. When the decision is made for that operation alone, it is recorded as a "policy-decision" type Event Object (see Section 4.1). If the operation is allowed, or permission is required and is granted, the operation is performed. For a tool invocation, the next Event Object is then the "tool-invocation" type Event Object (see Section 5). If the operation is disallowed, or permission is required and is not granted, the operation is not performed.¶

The state before an operation is set by the policy decision which applies to it: a "policy-decision" type Event Object for that operation alone, or a standing decision in effect for it (see Section 4.1). An operation covered by a standing decision has no "policy-decision" type Event Object of its own. When no policy decision for an operation was observed (e.g. by an observer at the tool), the vCon contains no "policy-decision" type Event Object for it.¶

The policy decision follows the state model shown in Figure 1.¶

                     policy-decision
                            |
      +---------------------+----------------------+
      | allowed             | permission-required  | disallowed
      v                     v                      v
 +---------+     +---------------------+     +------------+
 | Allowed |     | Permission Required |     | Disallowed |
 +---------+     +---------------------+     +------------+
      |                     | (1)
      +---------------------+
                            v
                operation is performed
                (e.g. tool-invocation)

  (1) permission granted (see Requirements for Permission and
      Directive Events)

The states are:¶

• Allowed - the policy decision is that no permission is needed¶

• Permission Required - the policy decision is that permission is required before the operation is performed¶

• Disallowed - the policy decision is that the operation is disallowed, and it is not performed¶

The following table defines the transitions.¶

The request for permission and the response are not defined in this document (see Section 7). When permission is not granted, the operation is not performed, and for a tool invocation no "tool-invocation" type Event Object follows. The Event Objects of this document alone do not distinguish permission refused, from no response, from a response which was not observed.¶

5. Tool Invocation State Model

A tool invocation starts with a "tool-invocation" type Event Object, after any policy decision which applies to it (see Section 4). The invocation, and each attempt of it, follows the state model shown in Figure 2. Each transition is recorded as an Event Object of the type that labels it.¶

                tool-invocation (attempt n) <- - - - - - - - - -+
                            |                                   .
+- Active ------------------|-------------------------------+   .
| +- Working ---------------|-----------------------------+ |   .
| |                         v                             | |   .
| |   +-----------+   tool-pending   +-----------+        | |   .
| |   |  Running  |----------------->|  Pending  |        | |   .
| |   +-----------+                  +-----------+        | |   .
| |       ^   |                        |   ^              | |   .
| |   (2) |   | (1)                (1) |   | (2)          | |   .
| |       |   v                        v   |              | |   .
| |   +----------------------------------------+          | |   .
| |   |             Input Required             |          | |   .
| |   +----------------------------------------+          | |   .
| +-------------------------------------------------------+ |   .
|         |                          |                      |   .
|         | tool-timeout             | tool-cancel          |   .
|         v                          v                      |   .
|   +-----------+  tool-cancel  +------------------+        |   .
|   | Timed Out |-------------->| Cancel Requested |        |   .
|   +-----------+               +------------------+        |   .
+-----------------------------------------------------------+   .
                            |                                   .
       tool-result, tool-failure, tool-error, tool-denied       .
                            v                                   .
+- Attempt Ended -------------------------------------------+   .
|  +-----------+  +--------+  +---------+  +--------+       |   .
|  | Completed |  | Failed |  | Errored |  | Denied |       |- -+
|  +-----------+  +--------+  +---------+  +--------+       |
+-----------------------------------------------------------+

  (1) tool-input   (2) tool-input-response
  tool-progress may occur in Running, Pending, Timed Out and
  Cancel Requested.
  - - - next attempt: same operation_id, attempt n + 1

The states are:¶

• Running - the request has been sent to the tool and it is performing the operation¶

• Pending - the tool has accepted the request and will complete it later¶

• Input Required - the tool has asked the agent for input before it continues¶

• Timed Out - the agent has stopped waiting for a response¶

• Cancel Requested - the agent has asked the tool to stop¶

• Completed, Failed, Errored and Denied - the attempt has ended¶

Running, Pending and Input Required are the Working states. The Working states, Timed Out and Cancel Requested are the Active states. Timed Out and Cancel Requested are not final. A tool may still respond after the agent has timed out or asked it to stop, and that response is recorded.¶

The following table defines the transitions.¶

TODO: should a "tool-input-response" type Event Object return to the state from which the input was requested, as above, or always to Running?¶

A vCon records what was observed. An Event Object which does not follow the state model (e.g. because an earlier Event Object was not observed) is still recorded.¶

6. Parameter Definitions

7. Requirements for Permission and Directive Events

This section is informative.¶

When a policy decision requires permission, or an agent needs direction, the agent asks the person or agent on whose behalf it is acting, and they respond. These requests and responses are part of the conversation. They occur outside tool invocations as well as within them, and also in contact centers (e.g. consent to record and IVR menu choices). For this reason they are not defined in this document. Event Object types for them need to be defined in a future document. The following requirements have been identified so far.¶

• PD-1: permission requests and responses, with responses beyond yes or no (e.g. allow once, allow for the Session, always allow or a choice from a menu)¶

• PD-2: a request and its response refer to the policy decision and the operation they apply to (e.g. by operation_id)¶

• PD-3: a response given by a button press (e.g. a "keydown" type Event Object) is linked to the request it answers¶

• PD-4: a question from a tool ("tool-input") which is passed on to the person or a parent agent, and its answer, are correlated with the "tool-input"¶

• PD-5: step-up consent after a "tool-denied" (e.g. an [MCP] HTTP 403 with insufficient scope) is correlated with the retried attempt¶

• PD-6: directive requests which are not about an operation (e.g. a clarifying choice put to a person)¶

• PD-7: a subagent asking its parent agent, rather than a person¶

• PD-8: directives no one asked for (e.g. stop, redirect, change of mode, and grant or revocation of a permission)¶

• PD-9: requests which end other than with an answer (withdrawn, timed out or expired, and declined versus dismissed)¶

• PD-10: requests passed along a chain of agents, and the answer passed back, across Sessions¶

• PD-11: who may answer a request, including more than one approver¶

• PD-12: answers given out of band (e.g. [MCP] URL mode elicitation), where only the outcome is observed¶

• PD-13: the kind of answer (e.g. free text, a form with a schema, or a single or multiple choice)¶

• PD-14: a response or an unprompted grant which changes the policy (e.g. always allow) is linked to the standing "policy-decision" type Event Object that follows it¶

In the absence of that document, a request and its response may be recorded with the existing Objects of [VCON-CORE]:¶

• the question and the answer as Dialog Objects¶

• a button press as a "keydown" type Event Object¶

These do not record the link to the policy decision and the operation, which is why Event Object types for requests and responses need to be defined.¶

8. Compatibility Considerations

The Event Object types defined in this document are new values of the Event Object type parameter. An implementation that does not recognize this extension ignores Event Objects with a type which it does not recognize, as described in [VCON-CORE]. It can still process the rest of the vCon correctly, as the Dialog, Attachment and other Objects do not depend on these Event Object types.¶

The parameters defined in this document apply only to the Event Object types defined in this document, and so are ignored with them.¶

9. Incompatibility Considerations

This extension introduces no incompatibilities in the processing of the conversation itself.¶

TODO: the content of the tool event types may contain data that must be redacted (see Section 10). An implementation that redacts a vCon but does not recognize this extension might copy the tool event types unchanged into the redacted vCon. Decide whether "tool-invocation" is therefore required in the critical parameter when tool event types with content are present, or whether [VCON-CORE] already requires unrecognized Objects to be removed when redacting.¶

10. Privacy and Integrity Considerations

The content of the tool event types can contain personally identifiable information, party identifying data, the contents of files, credentials and other secrets, and data belonging to third parties. The arguments of a "tool-invocation" and the output of a "tool-result" are the most likely to contain such data. The content of the tool event types is subject to redaction in the same way as Dialog Object content in [VCON-CORE]. The body or url parameter MAY be absent in a redacted vCon.¶

The tool and server parameters can themselves reveal information about the conversation (e.g. the name of a tool which accesses a medical record). The reason parameter of a "policy-decision" type Event Object can reveal the policy of the host, and may contain data from the conversation.¶

Externally referenced content MUST have a content_hash, as for other externally referenced files in [VCON-CORE].¶

Credentials (e.g. access tokens) used to invoke a tool MUST NOT be recorded in the Event Object types defined in this document. This includes the content of a "tool-denied" type Event Object.¶

11. Security Considerations

The security considerations of [VCON-CORE] apply.¶

• The output of a tool may contain instructions intended to manipulate an agent (e.g. prompt injection). Such content is recorded as it was received, and implementations processing a vCon MUST NOT act on instructions in the content of the tool event types.¶

• TODO: other security considerations.¶

12. IANA Considerations

13. References

Appendix A. Mapping to MCP

This appendix describes how the Event Object types defined in this document map to the messages of [MCP]. The mapping is informative. It is given for two revisions, [MCP-2025-11-25] and [MCP-2026-07-28], as the later revision changes how input, pending operations and retries are handled.¶

Notes:¶

• The operation_id is not the JSON-RPC request id, which changes when a request is reissued.¶

• The server parameter is the URL of a server reached over HTTP, or the name in serverInfo of a server reached over stdio. [MCP] tool names are unique within a server, and [MCP] says the serverInfo name is not guaranteed to be unique.¶

• In [MCP-2026-07-28], input is supplied by retrying the original request. TODO: decide whether that retry is a new attempt, with a "tool-invocation" type Event Object, or only a "tool-input-response" type Event Object in the same attempt.¶

• A tool reached over the stdio transport has no HTTP response, so a refusal by it is reported as a tool execution error and recorded as "tool-failure".¶

• After an HTTP 403 with insufficient scope, a client acting for a user may obtain a token with more scope and retry the request. The retry is a new attempt of the same invocation (see Section 5.1). The consent of the user is a permission request (see PD-5 in Section 7).¶

• In [MCP-2026-07-28], notifications/cancelled MUST NOT be used to cancel a task, which is cancelled with tasks/cancel. Cancellation of a task is cooperative, and the task may still end with another status.¶

• A sampling/createMessage request from the server, which is deprecated in [MCP-2026-07-28], is not supported by this document.¶

Appendix B. Example vCons

TODO¶

Appendix C. JSON Schema for the tool-invocation Extension

This appendix provides a JSON schema for the parameters defined by the tool-invocation extension. The text in the preceding sections of this document defines the normative definition of these parameters. If the JSON schema provided below differs from that in the text of the preceding sections, the text is the definitive definition and the JSON schema below is to be considered incorrect.¶

This schema supplements, and does not replace, the core vCon JSON schema. To fully validate a vCon that uses this extension, apply both the core vCon schema and this schema to the vCon.¶

The JSON schema definition below has been formatted with line breaks to print nicely on the page. The unformatted version of the JSON schema can be downloaded from: https://raw.githubusercontent.com/dgpetrie/draft-petrie-vcon-tool-invocation/refs/heads/main/tool_invocation_json_schema.json¶

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://ietf.org/vcon/schemas/tool-invocation-extension
    .json",
  "title": "vCon Tool Invocation (tool-invocation) Extension",
  "description": "Supplemental JSON schema for the Event Object t
    ypes and parameters defined by the vCon tool-invocation exten
    sion, RFCXXXX. This schema is applied in addition to the core
     vCon schema; it constrains only the Event Object types and p
    arameters added by this extension and leaves all other parame
    ters to the core schema. The text of this document is normati
    ve; this schema is informational.",
  "type": "object",
  "properties": {
    "events": {
      "type": "array",
      "items": {
        "$ref": "#/definitions/EventToolInvocationExtension"
      }
    }
  },
  "definitions": {
    "EventToolInvocationExtension": {
      "type": "object",
      "description": "Event Object types and parameters added to
        the core Event Object by the tool-invocation extension",
      "properties": {
        "type": {
          "type": "string",
          "description": "policy-decision, tool-invocation, tool-
            pending, tool-progress, tool-input, tool-input-respon
            se, tool-result, tool-failure, tool-error, tool-denie
            d, tool-timeout or tool-cancel, in addition to the co
            re Event Object types"
        },
        "decision": {
          "type": "string",
          "enum": [
            "allowed",
            "permission-required",
            "disallowed"
          ],
          "description": "Outcome of a policy decision (policy-de
            cision only)"
        },
        "policy_life": {
          "type": "string",
          "enum": [
            "once",
            "standing"
          ],
          "description": "Whether a policy decision applies to on
            e operation only or is standing (policy-decision only
            )"
        },
        "reason": {
          "type": "string",
          "description": "Reason for a policy decision (policy-de
            cision only)"
        },
        "operation": {
          "type": "string",
          "description": "Kind of operation to which a policy dec
            ision applies; this document defines tool-invocation
            (policy-decision only)"
        },
        "operation_id": {
          "type": "string",
          "description": "Identifier of the operation; the same f
            or all Event Objects of an operation, across all of i
            ts attempts; not present in standing policy decisions
            "
        },
        "attempt": {
          "type": "integer",
          "minimum": 1,
          "description": "Attempt of the operation, starting at 1
            ; not present in standing policy decisions"
        },
        "server": {
          "type": "string",
          "description": "URL of the server which provides the to
            ol, otherwise its name, or !host for a tool provided
            by the host (policy-decision and tool-invocation only
            )"
        },
        "tool": {
          "type": "string",
          "description": "Name of the tool as known to the server
             (policy-decision and tool-invocation only); absent i
            n a standing policy decision for all of the tools of
            the server"
        },
        "mediatype": {
          "type": "string",
          "description": "Media type of the content of a tool eve
            nt type; MUST be present for inline content"
        },
        "encoding": {
          "type": "string",
          "description": "Encoding of the inline content of a too
            l event type: json, none or base64url"
        },
        "body": {
          "description": "Inline content of a tool event type; an
            y JSON value when encoding is json, otherwise a strin
            g"
        },
        "url": {
          "type": "string",
          "description": "URL of the externally referenced conten
            t of a tool event type"
        },
        "content_hash": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^[a-z0-9]+-[A-Za-z0-9_-]+$"
            },
            {
              "type": "array",
              "items": {
                "type": "string",
                "pattern": "^[a-z0-9]+-[A-Za-z0-9_-]+$"
              }
            }
          ],
          "description": "Hash of the externally referenced conte
            nt of a tool event type"
        },
        "attachment": {
          "oneOf": [
            {
              "type": "integer",
              "minimum": 0
            },
            {
              "type": "array",
              "items": {
                "type": "integer",
                "minimum": 0
              }
            }
          ],
          "description": "Index or indices of the Attachment Obje
            cts passed to or returned by the tool (tool event typ
            es only)"
        }
      },
      "allOf": [
        {
          "if": {
            "properties": {
              "type": {
                "enum": [
                  "policy-decision"
                ]
              }
            },
            "required": [
              "type"
            ]
          },
          "then": {
            "required": [
              "sessions",
              "party",
              "decision",
              "policy_life",
              "operation",
              "server"
            ],
            "allOf": [
              {
                "not": {
                  "anyOf": [
                    {
                      "required": [
                        "mediatype"
                      ]
                    },
                    {
                      "required": [
                        "encoding"
                      ]
                    },
                    {
                      "required": [
                        "body"
                      ]
                    },
                    {
                      "required": [
                        "url"
                      ]
                    },
                    {
                      "required": [
                        "content_hash"
                      ]
                    },
                    {
                      "required": [
                        "attachment"
                      ]
                    }
                  ]
                }
              },
              {
                "if": {
                  "properties": {
                    "policy_life": {
                      "const": "once"
                    }
                  },
                  "required": [
                    "policy_life"
                  ]
                },
                "then": {
                  "required": [
                    "operation_id",
                    "attempt",
                    "tool"
                  ]
                },
                "else": {
                  "not": {
                    "anyOf": [
                      {
                        "required": [
                          "operation_id"
                        ]
                      },
                      {
                        "required": [
                          "attempt"
                        ]
                      }
                    ]
                  }
                }
              }
            ]
          }
        },
        {
          "if": {
            "properties": {
              "type": {
                "enum": [
                  "tool-invocation",
                  "tool-pending",
                  "tool-progress",
                  "tool-input",
                  "tool-input-response",
                  "tool-result",
                  "tool-failure",
                  "tool-error",
                  "tool-denied",
                  "tool-timeout",
                  "tool-cancel"
                ]
              }
            },
            "required": [
              "type"
            ]
          },
          "then": {
            "required": [
              "sessions",
              "party",
              "operation_id",
              "attempt"
            ],
            "allOf": [
              {
                "not": {
                  "anyOf": [
                    {
                      "required": [
                        "decision"
                      ]
                    },
                    {
                      "required": [
                        "policy_life"
                      ]
                    },
                    {
                      "required": [
                        "reason"
                      ]
                    },
                    {
                      "required": [
                        "operation"
                      ]
                    }
                  ]
                }
              },
              {
                "if": {
                  "properties": {
                    "body": {}
                  },
                  "required": [
                    "body"
                  ]
                },
                "then": {
                  "required": [
                    "encoding"
                  ],
                  "not": {
                    "required": [
                      "url"
                    ]
                  }
                }
              },
              {
                "if": {
                  "required": [
                    "url"
                  ]
                },
                "then": {
                  "required": [
                    "content_hash"
                  ]
                }
              }
            ]
          }
        },
        {
          "if": {
            "properties": {
              "type": {
                "enum": [
                  "tool-invocation"
                ]
              }
            },
            "required": [
              "type"
            ]
          },
          "then": {
            "required": [
              "server",
              "tool"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "type": {
                "enum": [
                  "tool-pending",
                  "tool-progress",
                  "tool-input",
                  "tool-input-response",
                  "tool-result",
                  "tool-failure",
                  "tool-error",
                  "tool-denied",
                  "tool-timeout",
                  "tool-cancel"
                ]
              }
            },
            "required": [
              "type"
            ]
          },
          "then": {
            "not": {
              "anyOf": [
                {
                  "required": [
                    "server"
                  ]
                },
                {
                  "required": [
                    "tool"
                  ]
                }
              ]
            }
          }
        }
      ]
    }
  }
}

Appendix D. CDDL for the tool-invocation Extension

This appendix provides a [CDDL] definition for the parameters defined by the tool-invocation extension. The text in the preceding sections of this document defines the normative definition of these parameters. If the CDDL provided below differs from that in the text of the preceding sections, the text is the definitive definition and the CDDL below is to be considered incorrect.¶

This CDDL is used together with the core vCon CDDL in [VCON-CORE]. It adds Event Object types through the event-type-ext socket of the core CDDL, and needs no other core socket. Each Event Object type it defines ends with a socket of its own, so that another vCon extension can add parameters to it.¶

The unformatted version of the CDDL can be downloaded from: https://raw.githubusercontent.com/dgpetrie/draft-petrie-vcon-tool-invocation/refs/heads/main/tool_invocation.cddl¶

; CDDL for the tool-invocation vCon extension
; (draft-petrie-vcon-tool-invocation).
; The prose of the draft is normative.
; This CDDL is informative.
; Constraints that cannot be expressed in CDDL are stated in
; comments.
;
; This CDDL is used together with the core vCon CDDL
; (draft-ietf-vcon-vcon-core, syntax version 0.5.0).
; It adds Event Object types through the event-type-ext socket of
; the core CDDL, and uses no other core socket.
; It uses these rules of the core CDDL: date_type,
; session_index_or_list_type, party_index_type,
; attachment_index_or_list_type, media_type_value_type and
; file_content_type.
;
; Each Event Object type defined here ends with a socket of its
; own, so that another vCon extension can add parameters to it.
; A policy decision for another kind of operation is added by
; another vCon extension, as a group of its own with the type
; "policy-decision" and its own operation value, through the
; event-type-ext socket.
;
; Not enforced by this CDDL:
; - A vCon which contains these Event Object types SHOULD list
;   "tool-invocation" in its extensions parameter.
; - operation_id MUST be unique among the operations in the vCon,
;   and all of the Event Objects of an operation, across all of
;   its attempts, MUST have the same operation_id.
; - Each later attempt of an operation is one more than the
;   attempt before it.
; - mediatype MUST be present for inline content.

$$event-type-ext //= ( event_policy_decision_once_type )
$$event-type-ext //= ( event_policy_decision_standing_type )
$$event-type-ext //= ( event_tool_invocation_type )
$$event-type-ext //= ( event_tool_response_type )

; Parameters common to the Event Object types of this extension
; party references the agent, also in the Event Objects for
; policy decisions and for responses from the tool.
event_ti_common_type = (
    "time": date_type,
    sessions: session_index_or_list_type,
    party: party_index_type
  )

; Policy decision event type
policy_decision_value_type = "allowed" / "permission-required" /
    "disallowed"

; Parameters common to the policy-decision type
policy_decision_common_type = (
    type: "policy-decision",
    event_ti_common_type,
    decision: policy_decision_value_type,
    ? reason: tstr
  )

; A decision for one tool invocation
event_policy_decision_once_type = (
    policy_decision_common_type,
    operation: "tool-invocation",
    policy_life: "once",
    operation_id: tstr,
    attempt: attempt_value_type,
    tool_identity_type,
    * $$event-policy-decision-ext
  )

; A standing decision for one tool, or for all of the tools of a
; server when tool is absent
; Not enforced by this CDDL:
; - A standing decision applies until a later policy-decision type
;   Event Object for the same operation and target replaces it, or
;   until the end of the vCon.
event_policy_decision_standing_type = (
    policy_decision_common_type,
    operation: "tool-invocation",
    policy_life: "standing",
    server: server_value_type,
    ? tool: tstr,
    * $$event-policy-decision-ext
  )

; The server and the tool together identify a tool.
tool_identity_type = (
    server: server_value_type,
    tool: tstr
  )

; The URL of the server when it has one, otherwise the name of the
; server, or "!host" for a tool provided by the host.
; Not enforced by this CDDL:
; - A server name MUST NOT start with "!".
server_value_type = tstr

; Parameters common to the tool event types
event_tool_common_type = (
    event_ti_common_type,
    operation_id: tstr,
    attempt: attempt_value_type
  )

; Content of a tool event type, inline or externally referenced
; as for Dialog Content in the core CDDL.
; Not enforced by this CDDL:
; - Content SHOULD be present in the tool event types, other than
;   tool-pending, tool-timeout and tool-cancel, in which it is
;   optional (see Event Object Parameter Applicability by Type).
event_tool_content_type = (
    ? mediatype: media_type_value_type,
    file_content_type
  )

; Tool invocation event type
; The content is the arguments sent to the tool.
event_tool_invocation_type = (
    type: "tool-invocation",
    event_tool_common_type,
    tool_identity_type,
    ? event_tool_content_type,
    ? attachment: attachment_index_or_list_type,
    * $$event-tool-invocation-ext
  )

; Event types for the responses from the tool, and for the input,
; timeout and cancellation of the agent
; Not enforced by this CDDL:
; - tool-denied is used only when the response from the tool is
;   identified by the protocol as a denial.
event_tool_response_type = (
    type: "tool-pending" / "tool-progress" / "tool-input" /
      "tool-input-response" / "tool-result" / "tool-failure" /
      "tool-error" / "tool-denied" / "tool-timeout" /
      "tool-cancel",
    event_tool_common_type,
    ? event_tool_content_type,
    ? attachment: attachment_index_or_list_type,
    * $$event-tool-ext
  )

; The first attempt of an operation is 1.
attempt_value_type = uint .ge 1

Acknowledgments

Author's Address