move_device_to_adom

What move_device_to_adom does on Fortimanager

AI agents use move_device_to_adom to create or update resources in Fortimanager, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Fortimanager environment.

Why move_device_to_adom is rated Medium

The tool moves a device to a different ADOM, which is a reversible organizational change that modifies FortiManager's configuration. This is Write-category because it updates device assignments without permanently deleting data. Severity is medium due to potential operational impact if devices are moved to wrong domains, affecting network policy enforcement and management access, though the action is reversible.

From the tool's definition Tool name 'move_device_to_adom' indicates modification of device organization/assignment within FortiManager's Administrative Domain (ADOM) structure. No description provided, but the action of 'move' implies updating device state/location.

The rule that runs move_device_to_adom safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Fortimanager, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For move_device_to_adom, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "move_device_to_adom": {
      "limits": [
        {
          "counter": "move_device_to_adom_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about move_device_to_adom