create_adom_with_device_assignment

What create_adom_with_device_assignment does on Fortimanager

AI agents use create_adom_with_device_assignment to create or update resources in Fortimanager, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Fortimanager environment.

Why create_adom_with_device_assignment is rated Medium

The 'create' verb indicates this tool creates new configuration entities (ADOM) and modifies assignments reversibly. This is a Write operation—it creates or modifies data that can be undone. Severity is medium because an adversary could create unauthorized administrative domains and assign devices, potentially establishing unauthorized management structures, but this does not directly delete data or move money.

From the tool's definition Tool name includes 'create_adom_with_device_assignment' which indicates creation of an administrative domain (adom) and assignment of devices. No description provided; classification based on the 'create' action in the name.

The rule that runs create_adom_with_device_assignment safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Fortimanager, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For create_adom_with_device_assignment, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_adom_with_device_assignment": {
      "limits": [
        {
          "counter": "create_adom_with_device_assignment_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about create_adom_with_device_assignment