The authorization request
The tool call becomes a standard question in the AuthZEN format, with subject, action, resource and context.
The PDP does not read JSON-RPC and does not know the format of each tool. It receives a standard question: who, wants to do what, on what, in which context. Building that question is the PEP's job, and this is where the tool call stops being MCP-specific.
Three pieces go into it. The standard of the question is AuthZEN. The rule that says which tool argument is the resource is the COAZ-MCP mapping. And one part of the question, the one that identifies the agent and the tool, is written only by the PEP, because it comes from sources that the mapping cannot touch (Trusted context).