Scoped T3 MCP tokens for agent sessions: tool allowlist, thread scope, delegation caps

[ViperJuice]

Problem

Each agent session's T3 MCP token (for the orchestrator and preview tools) carries the user's full capability. It can:

• read any thread;
• send to any thread, up to its runtime-mode ceiling;
• spawn delegate_task children on any enabled provider;
• act on linked environments.

There's no way to give a particular session or child a narrower set: a tool allowlist, allowed provider/model targets, a delegation depth or fan-out cap, a budget, or "this thread and its own children only". A read-only session is fenced only by the client's tool list, while the token itself stays full-capability.

That makes it hard to let less-trusted agents, such as ones reviewing untrusted code, use any T3 tool at all without handing them everything.

Proposed solution

Scoped tokens or session policies, set at delegation or launch time, for example:

• a tool allowlist (preview_snapshot, t3_thread_read:self, …);
• thread scope: self plus own children;
• delegate_task limits: allowed targets, maxDepth, maxChildren, budget;
• environment scope: none / named environments;
• the server enforces the policy, so the client's tool list isn't the only fence.

Also: let linked environments be added with less than full access, for example read-only or no delegation.

Related

#32133 asks for scoped approvals for MCP Apps in the UI. This request is about server-side scoping of the agent's own T3 token.

[ViperJuice]

Related: #32225 asks for execution bounds that the server enforces on delegated tasks, such as child lifetime and resource limits. The delegation caps proposed here (depth, fan-out, budget) fit alongside that. This request is about what a session's token may do; #32225 is about how long and how heavily a child may run.