Composio agent writes bypass the approval gate

[simplenaive]

Bug

Agent-driven Composio writes such as GMAIL_SEND_EMAIL declare PermissionLevel::Write but not an external effect. ApprovalSecurityMiddleware only parks calls whose external_effect_with_args is true, so both the dispatcher and per-action tool surfaces execute without an approval card.

Impact

• Emails, calendar changes, repository changes, and other external writes can occur without the configured human confirmation.
• Both composio_execute and dynamically registered ComposioActionTool instances are affected.
• Read-only actions should remain unprompted.

Root cause

Tool privilege caps and interactive approval are separate contracts. Both Composio tool surfaces set permission_level but inherit the default external_effect = false.

Proposed fix

Reuse the existing static ToolScope classification synchronously. Declare Write and Admin actions as external effects, keep Read actions non-effectful, and fail closed for malformed or missing dispatcher slugs.

Acceptance criteria

• GMAIL_SEND_EMAIL and admin/delete actions require approval on both Composio tool surfaces.
• Read actions such as GMAIL_FETCH_EMAILS remain unprompted.
• A missing or blank dispatcher slug is treated conservatively.
• Focused regression tests cover both tool surfaces.

Related

• Critical approval slice of Composio write actions run without an approval prompt, and the agent path stores the raw provider envelope #5299.
• Supersedes the approval portion of conflicting PR fix(composio): gate write actions through approval + reshape agent-path results #5259; response-shaping work remains separate.

[tinysweeper]

Agent-driven Composio writes bypass the configured approval gate because external_effect is not set for Write/Admin actions.

Labelled priority: p1.