Tool-Call Authorization

1. What exactly is Tool-Call Authorization?

Your support chatbot answers account-specific questions, like an order status, by calling a backend function through a tool-calling plugin, reaching your system through an MCP server. That function takes a customer ID as one of its parameters.

Azure OpenAI decides what value goes into that parameter, using anything in the conversation, including whatever the customer just typed. So a customer types a different account's customer ID along with their question. Azure OpenAI passes that ID straight into the function call, and your backend hands back that account's real data to whoever asked.

The function trusts whichever customer ID it's handed. It never checks whether that ID actually belongs to the person on the other end of the conversation. That's exactly what tool-call authorization fixes.

2. How would you fix it in .NET/Azure?

Tool-call authorization takes that decision away from the model entirely: identify the real customer once, from login or account context, when the chat session starts, and keep that ID with the session, outside anything Azure OpenAI can touch. Have the plugin ignore any customer ID Azure OpenAI tries to pass into the function call, and use the session's own customer ID for every backend call instead, every single time.

Use: Semantic Kernel (KernelFunction)

Decide who someone is once, at login, not again on every request based on whatever they happen to type.

3. How can you visualize it in everyday terms?

A bank teller could ask "what's your account number?" and just believe whatever number the customer says.

A careful teller instead looks up the account tied to the ID or card the customer already presented, and ignores any different number the customer says out loud.

The teller who checks the account on file, not the number the customer happens to say.