Promote pressure events to a foundation. When you see a pattern across multiple pressure events, promote them to a foundation. Foundations start with confidence 1/3 and evolve based on future outcomes. Use scope:
AI agents use promote_to_foundation to create or update resources in Decision OS MCP — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Decision OS MCP environment.
The tool creates new foundation entries (writes to a persistent knowledge base) and modifies system state by elevating pressure events into structured learning artifacts. While reversible (foundations can presumably be edited or removed), this is a direct write operation that affects organizational knowledge and future decision-making.
From the tool's definition Tool promotes pressure events to a foundation, which 'start with confidence 1/3 and evolve based on future outcomes' — this creates and modifies persistent knowledge base entries that persist across the system.
Attacks that exploit this kind of access
Promote pressure events to a foundation. When you see a pattern across multiple pressure events, promote them to a foundation. Foundations start with confidence 1/3 and evolve based on future outcomes. Use scope:. It is categorised as a Write tool in the Decision OS MCP MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Register the Decision OS MCP server in PolicyLayer and add a rule for promote_to_foundation: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Decision OS MCP. Nothing to install.
promote_to_foundation is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the promote_to_foundation rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for promote_to_foundation. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
promote_to_foundation is provided by the Decision OS MCP server (marianstefi20/decision-os-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →