vendJWTWithId

What vendJWTWithId does on Fusionauth

AI agents use vendJWTWithId to create or update resources in Fusionauth, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Fusionauth environment.

Why vendJWTWithId is rated Medium

Vending (issuing) JWTs creates new authentication tokens that can be used to access protected resources. This is fundamentally a write operation that creates security artifacts. While not destructive or financial, issuance of JWT tokens by an AI agent without proper authorization could grant unintended access to systems or users, posing a high severity risk.

From the tool's definition Tool name 'vendJWTWithId' indicates issuing/creating JWT tokens. The description 'It' is uninformative and truncated, which lowers confidence. JWT issuance is a write operation that creates authentication credentials with potential side effects if misused.

The rule that runs vendJWTWithId safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Fusionauth, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For vendJWTWithId, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "vendJWTWithId": {
      "limits": [
        {
          "counter": "vendjwtwithid_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about vendJWTWithId