Information leakage & egress
The subtlest breach isn't a wrong tool call — it's the right data reaching the wrong person. OAP's information-leakage gate treats that as an authorization question: who is allowed to see this data, and does the audience I'm about to send it to stay inside that set?
A tool call is an egress point, just like a reply
When a tool reads a resource, that read is tagged with the resource it came from. Then, whenever the agent is about to send something — a message to the channel or another tool call that carries the data outward — the gate computes who would receive it and intersects that against who is actually permitted to see the tagged data. A tool call carries data out exactly like a reply does, so both are checked at the same egress line.
If the audience stays within the permitted set, the data flows. If it would exceed it — a guest in the channel who can't see this customer's data, say — the gate stops and raises a leakage approval rather than letting the data slip out.
Routed to the data's owner, not the requester
Like shared permissions, the approval goes to whoever can speak for the data — its owner — not to whoever happens to be driving the session. It names exactly what would be shared and with whom, and only an owner of that data can approve the share.
