[Bug]: Able to save MCP Authz policy without any authorization rules

Please select the area the issue is related to

Platform API, AI Workspace

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI), Aspect/UI (Frontend layouts, components, styling)

Description

Users can attach and save MCP Authz policy to MCP proxies without rules for tools, resources, prompts for methods.

The request payload for the MCP proxy save contains the mcp-authz policy with only the name and version of the policy without parameters.

When the MCP proxy is deployed in a gateway it fails with a policy validation error.

gateway-controller-1  | time=2026-08-13T06:30:01.011Z level=ERROR source=/build/pkg/controlplane/client.go:2745 msg="Failed to create MCP proxy from YAML" proxy_id=019ff9a8-c504-7e9a-ba02-b35a0804ee89 error="failed to deploy MCP proxy configuration from YAML: configuration validation failed with 2 error(s): 1. spec.policies[0].params: Must validate at least one schema (anyOf); 2. spec.policies[0].params: tools is required"

Steps to Reproduce

1. Create MCP proxy
2. Attach MCP AuthZ policy without rules. Note that the Save button in the policy and the MCP proxy is enabled and clickable without any error.
3. Save and deploy the MCP proxy
4. An error is thrown from the gateway controller.

Severity Level of the Issue

Severity/Major (Important functionality is broken. Should be prioritized. Doesn't need immediate attention)

Environment Details (with versions)

No response

Trace the MCP proxy create, policy-edit, and save/deploy flows, then inspect the gateway-controller error location at pkg/controlplane/client.go:2745. Reproduce the empty MCP AuthZ policy case and identify where validation is missing before save. Done means an MCP AuthZ policy without tool, resource, or prompt rules cannot be saved or deployed without a clear validation error.