feat: complete v0.3.1 agent workflow

internal/agent/authorization.go

@@ -0,0 +1,26 @@
+package agent
+
+import "context"
+
+// ToolAuthorizationDecision is the result of an authorization check.
+type ToolAuthorizationDecision string
+
+const (
+	ToolAuthorizationAllow ToolAuthorizationDecision = "allow"
+	ToolAuthorizationDeny  ToolAuthorizationDecision = "deny"
+)
+
+// ToolAuthorizationRequest is sent to an authorizer before executing a
+// mutating tool call.
+type ToolAuthorizationRequest struct {
+	ID                string
+	ToolName          string
+	Arguments         string
+	Preview           string
+	RollbackAvailable bool
+}
+
+// ToolAuthorizer decides whether a mutating tool call should proceed.
+type ToolAuthorizer interface {
+	AuthorizeToolCall(ctx context.Context, req ToolAuthorizationRequest) (ToolAuthorizationDecision, error)
+}