Conversation
Contributor
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughThe documentation for task-based authorization in OpenFGA was updated to rephrase permission terminology, convert the expiration model from turn-count to call-count semantics, rename the agent relation from Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refines the Task-Based Authorization (TBAC) documentation for agents by improving wording, clarifying modeling patterns, and updating the conditions example from “turn count” to “tool call count”.
Changes:
- Reworded introductory and domain-modeling guidance to better frame TBAC and task principals.
- Updated the conditions example to use a
max_call_countcondition and related terminology (“call count”). - Expanded/adjusted later sections (agent binding naming, new tuple cleanup guidance, and an added further-reading resource).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/content/modeling/agents/task-based-authorization.mdx (1)
187-210:⚠️ Potential issue | 🟡 MinorClarify call-count boundary semantics to avoid off-by-one integrations.
current_tool_count < max_tool_callsis correct, but the docs should explicitly state whethercurrent_tool_countis evaluated before the attempted call (recommended) and show one concrete check-context example. Without that, implementers can enforce one extra or one fewer call.✍️ Suggested doc tweak
-The `expiration` condition grants access for a fixed duration from the grant time. The `max_call_count` condition limits how many times the tool can be called. When writing the tuple, you provide the condition parameters: +The `expiration` condition grants access for a fixed duration from the grant time. +The `max_call_count` condition limits how many times the tool can be called. +Evaluate `current_tool_count` **before** the attempted call (0-based). +When writing the tuple, you provide the condition parameters: @@ -When checking access, pass the current time or current call count in the request context. +When checking access, pass the current time or current call count in the request context. +Example for call count: `{"current_tool_count": 1}` with `max_tool_calls: 2` still allows the second call.Also applies to: 224-234
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/content/modeling/agents/task-based-authorization.mdx` around lines 187 - 210, Update the docs around the max_call_count condition to clarify boundary semantics: explicitly state that current_tool_count is evaluated before the attempted call (so the condition current_tool_count < max_tool_calls allows another call when the current count is strictly less than the limit), and add a concrete example showing values before and after a call (e.g., max_tool_calls=3, current_tool_count=2 permits the call; after the call current_tool_count becomes 3 and subsequent calls are denied). Reference the condition name max_call_count and the parameters max_tool_calls and current_tool_count so readers can find and update the explanation and add the single concrete check-context example in the same section.
🧹 Nitpick comments (1)
docs/content/modeling/agents/task-based-authorization.mdx (1)
319-319: Split the first “Further reading” bullet for scanability.This line is dense with three resources in one bullet; splitting into a primary link plus sub-links will improve readability.
✍️ Suggested formatting
-- [From Scopes To Intent: Reimagining Authorization for Autonomous Agents](https://mcpdevsummitna26.sched.com/event/2Hbg0/from-scopes-to-intent-reimagining-authorization-for-autonomous-agents-andres-aguiar-abhishek-hingnikar-okta), MCP Dev Summit NY 2026 [code repository](https://github.com/aaguiarz/ibac-talk-demo) and [demo](https://www.youtube.com/watch?v=IVIvtusd7LA) +- [From Scopes To Intent: Reimagining Authorization for Autonomous Agents](https://mcpdevsummitna26.sched.com/event/2Hbg0/from-scopes-to-intent-reimagining-authorization-for-autonomous-agents-andres-aguiar-abhishek-hingnikar-okta) — MCP Dev Summit NY 2026 + - [Code repository](https://github.com/aaguiarz/ibac-talk-demo) + - [Demo](https://www.youtube.com/watch?v=IVIvtusd7LA)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/content/modeling/agents/task-based-authorization.mdx` at line 319, Replace the single dense "Further reading" bullet that contains the "From Scopes To Intent: Reimagining Authorization for Autonomous Agents" entry with a primary bullet linking to the talk (use the existing title link as the main item) and two nested sub-bullets that separately link to the code repository and the demo/video; locate the line containing the full combined entry ("From Scopes To Intent: Reimagining Authorization for Autonomous Agents...") and split it into one top-level bullet for the talk and two indented bullets for "[code repository](https://github.com/aaguiarz/ibac-talk-demo)" and "[demo](https://www.youtube.com/watch?v=IVIvtusd7LA)" to improve scanability.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@docs/content/modeling/agents/task-based-authorization.mdx`:
- Around line 187-210: Update the docs around the max_call_count condition to
clarify boundary semantics: explicitly state that current_tool_count is
evaluated before the attempted call (so the condition current_tool_count <
max_tool_calls allows another call when the current count is strictly less than
the limit), and add a concrete example showing values before and after a call
(e.g., max_tool_calls=3, current_tool_count=2 permits the call; after the call
current_tool_count becomes 3 and subsequent calls are denied). Reference the
condition name max_call_count and the parameters max_tool_calls and
current_tool_count so readers can find and update the explanation and add the
single concrete check-context example in the same section.
---
Nitpick comments:
In `@docs/content/modeling/agents/task-based-authorization.mdx`:
- Line 319: Replace the single dense "Further reading" bullet that contains the
"From Scopes To Intent: Reimagining Authorization for Autonomous Agents" entry
with a primary bullet linking to the talk (use the existing title link as the
main item) and two nested sub-bullets that separately link to the code
repository and the demo/video; locate the line containing the full combined
entry ("From Scopes To Intent: Reimagining Authorization for Autonomous
Agents...") and split it into one top-level bullet for the talk and two indented
bullets for "[code repository](https://github.com/aaguiarz/ibac-talk-demo)" and
"[demo](https://www.youtube.com/watch?v=IVIvtusd7LA)" to improve scanability.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 20a64444-7f97-49eb-ac48-4f5599cc46e5
📒 Files selected for processing (1)
docs/content/modeling/agents/task-based-authorization.mdx
saad-h1
approved these changes
Apr 5, 2026
curfew-marathon
approved these changes
Apr 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
What problem is being solved?
How is it being solved?
What changes are made to solve it?
References
Review Checklist
mainSummary by CodeRabbit
Release Notes