I've been working with the Anthropic Agent SDK for a few weeks now, and while I appreciate the tool-calling abstraction, I wanted more granular control over what my local tools can be asked to do. The SDK's permission system is a good start, but I found myself wanting a declarative, context-aware layer that sits between the agent's request and the actual tool execution.

My solution is a lightweight `PermissionGate` class that wraps my tool functions. It checks the tool name, parameters, and even the conversation context against a set of rules defined in a simple YAML configuration. This means I can have a single "file_write" tool, but the gate can allow or deny based on the target path, file extension, or whether the user session has been elevated.

Here's the core of it:

```python
class PermissionGate:
def __init__(self, rules_path):
self.rules = self._load_rules(rules_path)

def __call__(self, tool_name, tool_args, user_context):
for rule in self.rules.get(tool_name, []):
if self._evaluate_rule(rule, tool_args, user_context):
return rule.get('action', 'allow') == 'allow'
# Default deny
return False

def wrap_tool(self, func):
def wrapped(**kwargs):
# user_context derived from Flask's g or session
if not self(func.__name__, kwargs, g.user_context):
raise PermissionError(f"Operation not permitted for {func.__name__}")
return func(**kwargs)
return wrapped
```

I then decorate my tools with `@gate.wrap_tool`. The rules file lets me specify things like: "allow database_query only if the query is read-only and the user is authenticated" or "allow send_email only to specific domains and with a rate limit". The key for me is that this logic is entirely local, outside the SDK's and Anthropic's view. The agent just sees a tool call succeeded or failed.

I'm curious how others are handling this. Are you relying solely on the SDK's built-in permissions, or have you built additional layers? For those with more complex local toolkits, how are you managing the authorization flow?