Claus Ibsen created CAMEL-24831:
-----------------------------------
Summary: camel-ai-tool - component-level authorization hook so
tool routes are guarded by construction
Key: CAMEL-24831
URL: https://issues.apache.org/jira/browse/CAMEL-24831
Project: Camel
Issue Type: Improvement
Components: camel-ai
Reporter: Claus Ibsen
h2. Problem
A route exposed with {{ai-tool:}} is invoked by an AI agent (LangChain4j,
Spring AI, OpenAI, or the built-in MCP server) based on model output, so the
tool call is the security boundary. Today an authorization check has to be
added per route, either with {{.policy(authorizationPolicy)}} or with
{{routeConfigurationId}} pointing at a route configuration with an
{{interceptFrom}} guard. Both are opt-in: a tool route whose author forgets the
line is silently unguarded, which is the wrong default for a security control.
h2. Proposal
Let {{camel-ai-tool}} own the guard so every tool route is protected by
construction:
* Add an {{authorizationPolicy}} option (a {{#bean}} reference to an
{{org.apache.camel.spi.AuthorizationPolicy}}) on the {{ai-tool}} component,
applied to all tool routes, with an endpoint-level override.
* Implementation options: wrap the consumer's processor with
{{Policy.wrap(route, processor)}}, or ship a {{RoutePolicyFactory}} that
matches routes whose {{from}} is {{ai-tool:}} and wraps them. The check must
run inside the route's processors (not as an internal-processor advice) so a
deny is visible to tracing, route dump and the TUI.
* A deny ({{CamelAuthorizationException}}) should surface to the agent as a
short refusal the model can relay, instead of a silent failure or a stack trace.
* Make the policy input trustworthy: the tool name comes from the route/tool
id, never from model output; caller identity from an exchange property set
before the agent runs (e.g. by camel-spiffe or camel-keycloak) which the model
cannot set.
* The same guard must apply when the tools are served over the MCP server
(camel-mcp-server), since it uses the same registry.
Related: CAMEL-24743 and CAMEL-24830 (OpaSecurityPolicy WASM mode; in-process
OPA is the natural policy to plug in here).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
