startIdentityProviderLoginWithId

What startIdentityProviderLoginWithId does on Fusionauth

AI agents invoke startIdentityProviderLoginWithId to trigger actions in Fusionauth. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why startIdentityProviderLoginWithId is rated High

This tool initiates an external authentication operation with a third-party identity provider. While it doesn't directly modify persistent user state (which would be Write), it triggers an external process with side effects that depend on runtime parameters and external systems. The 'requires user interaction' phrase indicates this is an interactive operation rather than a simple Read.

From the tool's definition Tool description states it 'Begins a login request for a 3rd party login that requires user interaction'. The verb 'Begins' indicates the tool triggers an external operation (initiating a third-party authentication flow) whose actual effects depend on user…

The rule that runs startIdentityProviderLoginWithId safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Fusionauth, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For startIdentityProviderLoginWithId, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "startIdentityProviderLoginWithId": {
      "limits": [
        {
          "counter": "startidentityproviderloginwithid_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about startIdentityProviderLoginWithId