update_user_profile

What update_user_profile does on Huly

AI agents use update_user_profile to create or update resources in Huly, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Huly environment.

Why update_user_profile is rated Medium

The tool updates user profile information, which is a data modification action. It does not execute code, delete data irreversibly, move money, or trigger external operations. It falls squarely into the Write category. Severity is medium because unauthorized profile modifications could impact account security, permissions, or user identity, but the change is reversible.

From the tool's definition Tool name 'update_user_profile' and description 'Update the current user' indicate modification of user account data. This is a reversible Write operation that creates or modifies data without deletion or execution of arbitrary code.

The rule that runs update_user_profile safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Huly, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For update_user_profile, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "update_user_profile": {
      "limits": [
        {
          "counter": "update_user_profile_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about update_user_profile