How do I choose between using Catalyst’s built-in identity policies versus implementing my own authorization layer for agent tools?

Catalyst’s built-in policies handle the most common blast-radius containment scenarios out of the box—identity-based allow/deny lists for MCP tools. If your requirements include dynamic attribute-based access control (e.g., time-of-day or data sensitivity), you can extend with your own policy engine via Catalyst’s extensible authorization hooks. Start with Catalyst’s policies for simplicity; migrate to custom only if your compliance model demands it.