What problem does it solve? Understanding how authorization decisions are made for MCP tool calls in this banking demo is difficult because logic is spread across the gateway, the authorization server, and PingOne. This Skill documents the full architecture, API surface, and rule evaluation order so you can configure, debug, or swap in real PingOne Authorize without reading all the source code. ## Core Features & Use Cases - Architecture Reference: Maps the three-server flow (BFF, MCP Gateway, Authorization Server) and explains how RFC 8693 token exchange and the act claim are enforced. - API Documentation: Covers the introspection endpoint (RFC 7662), the PingOne Authorize decision endpoint, token endpoint, and runtime rule-store management endpoints. - Policy Rule Walkthrough: Details the ordered authorization rules including scope checks, act claim validation, deny ceilings, RAR, entitlement tiers, and two-tier HITL (step-up vs. consent). - Use Case: When a tool call is unexpectedly denied, use this Skill to trace which rule fired, check the decision logs, and adjust thresholds like SIMULATED_AUTHORIZE_STEPUP_AMOUNT or the runtime rule overlay. ## Quick Start Ask the AI to explain why a specific MCP tool call was denied by the authorization server and which rule or configuration value caused the decision.
