KR-AG-003: allowedTools Not Subset of tools - Kiro Agents
Summary
- Rule ID:
KR-AG-003 - Severity:
MEDIUM - Category:
Kiro Agents - Normative Level:
SHOULD - Auto-Fix:
No - Verified On:
2026-03-02
Applicability
- Tool:
kiro - Version Range:
unspecified - Spec Revision:
unspecified
Evidence Sources
Test Coverage Metadata
- Unit tests:
true - Fixture tests:
true - E2E tests:
false
Examples
The following examples demonstrate what triggers this rule and how to fix it.
Invalid
{
"tools": ["readFiles"],
"allowedTools": ["runShellCommand"]
}
Valid
{
"tools": ["readFiles", "listDirectory"],
"allowedTools": ["readFiles"]
}