🏗️ Architecture: How should MCP tool access be controlled by user type (T1/T2...

Date: 2026-02-06
Time: 00:57:04 UTC
Session: editor2-93.3
Agent: angular
Confidence: 88%
Status: ✅ Documented

📋 Decision Context

Question:

How should MCP tool access be controlled by user type (T1/T2/T3)?

Task: Phase 5A: Tier-aware MCP routing

🎯 Decision Made

Chosen:

Category-based tool access matrix in mcp-tiers.config.ts. 14 tool categories mapped to UserType arrays. 70+ individual tools mapped to categories via TOOL_TO_CATEGORY. canAccessTool(userType, toolName) function. TierLimitGuard checks tool access before volume limits, returns 403 FORBIDDEN for unauthorized access.

Options Considered:

• No alternatives documented

💭 Reasoning

Category-based grouping is more maintainable than per-tool ACLs — adding a new tool only requires mapping it to an existing category. Developers get full access, space_builders get space/learning/search tools, platform_users get only platform_info. Unknown tools default to developer-only for security. Guard checks tool access BEFORE volume limits to fail fast on unauthorized requests.

📁 Files Involved

• libs/libs-api/backend-core/src/lib/config/mcp-tiers.config.ts
• apis/backend-ai-api/src/app/mcp-gateway/guards/tier-limit.guard.ts

🔗 Related

• Decision ID: dev_1770339424773_n1988wv
• Session: 93
• Workspace: editor2

Auto-generated by MCP Smart Consolidation