resolveActingUserId
resolveActingUserId(
verifiedUserId,requestedUserId,scopes,toolAllowsDelegation):ActingUserDecision
Defined in: packages/core/src/mcp/tools/index.ts:159
Decide which tenant an identity-mode tool acts on. The verified identity
always wins for ordinary principals — the tenant boundary is the token, not
the request body. The one exception is delegation, which requires BOTH
conditions: the tool opts in (toolAllowsDelegation, from Tool.delegable)
AND the principal holds the admin scope. Such a principal may then
explicitly name another tenant in userId and have it honoured (the
multi-tenant operator-console case). Everyone else — non-admins, and admins
calling a non-delegable tool — is pinned back to their own tenant, preserving
the pre-existing overwrite behavior. Keeping both gates here means the full
cross-tenant decision lives in one auditable, unit-tested function.
Parameters
Section titled “Parameters”verifiedUserId
Section titled “verifiedUserId”string
requestedUserId
Section titled “requestedUserId”unknown
scopes
Section titled “scopes”readonly string[]
toolAllowsDelegation
Section titled “toolAllowsDelegation”boolean