@@ -1052,6 +1052,22 @@ the list side (`ListTools`/`ListResources`/`ListPrompts` filter the advertised s
 the call side (`CallTool`/`ReadResource`/`GetPrompt` deny before dispatch), closing the
 "list says yes / call says no" gap.
 
+For tool decisions, admission carries the advertised capability's trusted logical
+`BackendID` into Cedar. The request's `Tool` entity remains a child of the vMCP's
+`MCP` entity and also becomes a child of `Backend::<BackendID>`. Direct
+`resource in Backend::"..."` policies evaluate from that parent UID without a
+Backend entity in the request map; `entities_json` is needed only when the Backend
+has attributes or participates in a transitive hierarchy. Tool names and arguments
+are never used to infer backend membership.
+
+Composite tools have no single origin and therefore no Backend parent. Neither a
+backend-scoped `permit` nor a backend-scoped `forbid` matches them. A composite
+authorized by another policy may still invoke steps on a backend named by such a
+`forbid`, because workflow steps route internally rather than entering admission as
+separate top-level tool calls. Policies that restrict backends must encode the
+allowed backends in `permit` conditions and authorize composite Tool entities
+separately.
+
 Because the SDK maps a call-side deny to a tool result, a raw denied `tools/call` would
 otherwise return **HTTP 200** (either the SDK's `-32602 "not found"` for a list-filtered
 tool, or a `200 + IsError` tool result for an argument-gated deny). To make a denial a
 
@@ -239,6 +239,43 @@ permit(principal, action == Action::"call_tool", resource == Tool::"weather");
 
 This policy allows any client to call the weather tool.
 
+##### Allow tools from a specific vMCP backend
+
+For tools advertised by a Virtual MCP Server, Cedar receives the logical
+originating backend as a second resource parent:
+
+```text
+Tool::"search"
+  -> MCP::"main-vmcp"
+  -> Backend::"github-mcp"
+```
+
+This allows every tool from one backend without relying on the advertised tool
+name or its conflict-resolution prefix:
+
+```plain
+permit(
+  principal,
+  action == Action::"call_tool",
+  resource in Backend::"github-mcp"
+);
+```
+
+The Backend entity ID is the tool's logical vMCP `BackendID`, not a network
+address. ToolHive obtains it from the aggregated capability and uses the same
+value for list filtering and call authorization. A direct Backend policy does
+not require an entry in `entities_json`: Cedar evaluates it from the Backend UID
+in the Tool entity's parent set. Define the Backend in `entities_json` only when
+it needs attributes or parents for a transitive hierarchy.
+
+Composite tools have no single originating backend, so they have no Backend
+parent. Consequently, neither a backend-scoped `permit` nor a backend-scoped
+`forbid` matches a composite tool. If another policy permits the composite, a
+backend-scoped `forbid` does not prevent its workflow steps from reaching that
+backend because workflow steps are not authorized as separate top-level tool
+calls. Express backend restrictions as conditions on `permit` policies and
+authorize composite tools separately by their `Tool` entity.
+
 ##### Allow a specific prompt
 
 ```plain
 
@@ -42,10 +42,21 @@ func WithToolAnnotations(ctx context.Context, annotations *ToolAnnotations) cont
 }
 
 // ToolAnnotationsFromContext retrieves tool annotations previously stored with
-// WithToolAnnotations. It returns nil when no annotations are present.
+// WithToolAnnotations or as part of ResourceMetadata. It returns nil when no
+// annotations are present.
 func ToolAnnotationsFromContext(ctx context.Context) *ToolAnnotations {
-	v, _ := ctx.Value(toolAnnotationsKey{}).(*ToolAnnotations)
-	return v
+	return effectiveToolAnnotationsFromContext(ctx)
+}
+
+// effectiveToolAnnotationsFromContext keeps the legacy and unified metadata
+// readers consistent when both context channels are present. Unified resource
+// metadata is authoritative; the legacy value is a compatibility fallback.
+func effectiveToolAnnotationsFromContext(ctx context.Context) *ToolAnnotations {
+	if metadata, ok := ctx.Value(resourceMetadataKey{}).(ResourceMetadata); ok && metadata.Annotations != nil {
+		return metadata.Annotations
+	}
+	annotations, _ := ctx.Value(toolAnnotationsKey{}).(*ToolAnnotations)
+	return annotations
 }
 
 // AnnotationsToMap converts non-nil annotation fields to a flat map suitable
 
@@ -1079,18 +1079,27 @@ func (a *Authorizer) authorizeToolCall(
 	// Annotations are merged first so that the standard attributes ("name",
 	// "operation", "feature") always take precedence and cannot be overwritten
 	// by annotation keys — intentionally or accidentally.
-	annotationAttrs := authorizers.AnnotationsToMap(authorizers.ToolAnnotationsFromContext(ctx))
+	resourceMetadata, _ := authorizers.ResourceMetadataFromContext(ctx)
+	annotationAttrs := authorizers.AnnotationsToMap(resourceMetadata.Annotations)
 
 	// Create attributes for the entities
 	attributes := mergeContexts(annotationAttrs, attrsMap, map[string]interface{}{
 		"name":      toolName,
 		"operation": "call",
 		"feature":   "tool",
 	})
+	resourceParents := func() []cedar.EntityUID {
+		if resourceMetadata.BackendID == "" {
+			return nil
+		}
+		return []cedar.EntityUID{
+			cedar.NewEntityUID(EntityTypeBackend, cedar.String(resourceMetadata.BackendID)),
+		}
+	}()
 
 	// Create Cedar entities
 	entities, err := a.entityFactory.CreateEntitiesForRequest(
-		principal, action, resource, claimsMap, attributes, groups, a.serverName,
+		principal, action, resource, claimsMap, attributes, groups, a.serverName, resourceParents...,
 	)
 	if err != nil {
 		return false, fmt.Errorf("failed to create Cedar entities: %w", err)
 
@@ -2305,6 +2305,52 @@ func TestAuthorizeWithJWTClaims_TransitiveHierarchyPreserved(t *testing.T) {
 		"transitive hierarchy THVGroup→THVRole from entities_json must survive entity merge")
 }
 
+func TestAuthorizeWithJWTClaims_BackendHierarchyPreserved(t *testing.T) {
+	t.Parallel()
+
+	policy := `permit(
+		principal,
+		action == Action::"call_tool",
+		resource in BackendGroup::"production-approved"
+	);`
+	entitiesJSON := `[
+		{
+			"uid": {"type": "Backend", "id": "github-mcp"},
+			"attrs": {"environment": "production"},
+			"parents": [{"type": "BackendGroup", "id": "production-approved"}]
+		},
+		{
+			"uid": {"type": "BackendGroup", "id": "production-approved"},
+			"attrs": {},
+			"parents": []
+		}
+	]`
+
+	authorizer, err := NewCedarAuthorizer(ConfigOptions{
+		Policies:     []string{policy},
+		EntitiesJSON: entitiesJSON,
+	}, "main-vmcp")
+	require.NoError(t, err)
+
+	identity := &auth.Identity{PrincipalInfo: auth.PrincipalInfo{
+		Subject: "user1",
+		Claims:  map[string]any{"sub": "user1"},
+	}}
+	ctx := auth.WithIdentity(context.Background(), identity)
+	ctx = authorizers.WithResourceMetadata(ctx, authorizers.ResourceMetadata{BackendID: "github-mcp"})
+
+	authorized, err := authorizer.AuthorizeWithJWTClaims(
+		ctx,
+		authorizers.MCPFeatureTool,
+		authorizers.MCPOperationCall,
+		"renamed-search",
+		nil,
+	)
+	require.NoError(t, err)
+	assert.True(t, authorized,
+		"the Tool parent UID must traverse the configured Backend hierarchy")
+}
+
 // TestAuthorizeWithJWTClaims_DoesNotMutateIdentity verifies that
 // AuthorizeWithJWTClaims does not mutate the Identity stored in context.
 // The Identity contract (see auth.Identity) requires that the struct MUST NOT
 
@@ -17,11 +17,16 @@ import (
 // maxSchemaDepth in pkg/vmcp/composer/elicitation_handler.go for consistency.
 const maxClaimNestingDepth = 10
 
-// EntityTypeTHVGroup is the default Cedar entity type representing group membership.
-// It is used when ConfigOptions.GroupEntityType is empty. Principals are added as
-// children of group entities so that Cedar's `in` operator can evaluate
-// group-based policies (e.g. `principal in THVGroup::"engineering"`).
-const EntityTypeTHVGroup cedar.EntityType = "THVGroup"
+const (
+	// EntityTypeTHVGroup is the default Cedar entity type representing group membership.
+	// It is used when ConfigOptions.GroupEntityType is empty. Principals are added as
+	// children of group entities so that Cedar's `in` operator can evaluate
+	// group-based policies (e.g. `principal in THVGroup::"engineering"`).
+	EntityTypeTHVGroup cedar.EntityType = "THVGroup"
+	// EntityTypeBackend represents a logical vMCP backend. Tools are added as
+	// children of their originating backend for backend-scoped policies.
+	EntityTypeBackend cedar.EntityType = "Backend"
+)
 
 // EntityFactory creates Cedar entities for authorization.
 type EntityFactory struct {
@@ -130,13 +135,17 @@ func (*EntityFactory) CreateResourceEntity(
 // When serverName is non-empty, resource entities include an MCP parent UID so
 // that server-scoped Cedar policies (e.g. `resource in MCP::"github"`) evaluate
 // correctly via Cedar's `in` operator. When serverName is empty, resource
-// entities have no parents, preserving backward compatibility.
+// entities have no MCP parent, preserving backward compatibility. Additional
+// resource parent UIDs may be supplied for narrower scopes such as vMCP
+// backends; their corresponding entities, if needed for hierarchy traversal,
+// must come from entities_json.
 func (f *EntityFactory) CreateEntitiesForRequest(
 	principal, action, resource string,
 	claimsMap map[string]interface{},
 	attributes map[string]interface{},
 	groups []string,
 	serverName string,
+	extraResourceParents ...cedar.EntityUID,
 ) (cedar.EntityMap, error) {
 	// Parse principal, action, and resource
 	principalType, principalID, err := parseCedarEntityID(principal)
@@ -178,10 +187,11 @@ func (f *EntityFactory) CreateEntitiesForRequest(
 
 	// Build MCP parent for resource entity when serverName is set so that
 	// server-scoped policies (e.g. resource in MCP::"github") can match.
-	var resourceParents []cedar.EntityUID
+	resourceParents := make([]cedar.EntityUID, 0, 1+len(extraResourceParents))
 	if serverName != "" {
 		resourceParents = append(resourceParents, cedar.NewEntityUID("MCP", cedar.String(serverName)))
 	}
+	resourceParents = append(resourceParents, extraResourceParents...)
 
 	// Create resource entity
 	resourceUID, resourceEntity := f.CreateResourceEntity(resourceType, resourceID, attributes, resourceParents...)
 
@@ -427,7 +427,8 @@ func TestCreateCedarEntities(t *testing.T) {
 			factory := NewEntityFactory("")
 
 			// Create Cedar entities (no groups for these test cases)
-			entities, err := factory.CreateEntitiesForRequest(tc.principal, tc.action, tc.resource, tc.claimsMap, tc.attributes, nil, "")
+			entities, err := factory.CreateEntitiesForRequest(
+				tc.principal, tc.action, tc.resource, tc.claimsMap, tc.attributes, nil, "")
 
 			// Check error expectations
 			if tc.expectErr {
@@ -594,3 +595,71 @@ func TestCreateEntitiesForRequest_MCPParent(t *testing.T) {
 		})
 	}
 }
+
+func TestCreateEntitiesForRequest_BackendParent(t *testing.T) {
+	t.Parallel()
+
+	factory := NewEntityFactory("")
+	tests := []struct {
+		name            string
+		serverName      string
+		backendID       string
+		wantParentCount int
+	}{
+		{
+			name:            "MCP and Backend parents",
+			serverName:      "main-vmcp",
+			backendID:       "github-mcp",
+			wantParentCount: 2,
+		},
+		{
+			name:            "empty BackendID keeps only MCP parent",
+			serverName:      "main-vmcp",
+			wantParentCount: 1,
+		},
+		{
+			name:            "Backend parent does not require MCP parent",
+			backendID:       "github-mcp",
+			wantParentCount: 1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			var extraResourceParents []cedar.EntityUID
+			if tt.backendID != "" {
+				extraResourceParents = append(extraResourceParents,
+					cedar.NewEntityUID(EntityTypeBackend, cedar.String(tt.backendID)))
+			}
+
+			entities, err := factory.CreateEntitiesForRequest(
+				"Client::user1",
+				"Action::call_tool",
+				"Tool::renamed-search",
+				map[string]interface{}{"sub": "user1"},
+				map[string]interface{}{"name": "renamed-search"},
+				nil,
+				tt.serverName,
+				extraResourceParents...,
+			)
+			require.NoError(t, err)
+			assert.Len(t, entities, 3,
+				"request entities must contain only the principal, action, and resource")
+
+			toolUID := cedar.NewEntityUID("Tool", cedar.String("renamed-search"))
+			toolEntity, ok := entities[toolUID]
+			require.True(t, ok)
+			assert.Equal(t, tt.wantParentCount, toolEntity.Parents.Len())
+
+			if tt.backendID != "" {
+				backendUID := cedar.NewEntityUID(EntityTypeBackend, cedar.String(tt.backendID))
+				assert.True(t, toolEntity.Parents.Contains(backendUID),
+					"Tool must carry the trusted Backend parent UID")
+				assert.NotContains(t, entities, backendUID,
+					"request-time Backend parents must not be materialized as entities")
+			}
+		})
+	}
+}
@@ -0,0 +1,40 @@
+// SPDX-FileCopyrightText: Copyright 2025 Stacklok, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+package authorizers
+
+import "context"
+
+// ResourceMetadata carries trusted server-side facts about the resource being
+// authorized that are not part of the public Authorizer method signature.
+//
+// BackendID is the logical vMCP backend identifier. It MUST be sourced from the
+// aggregated capability, never from client-supplied request data such as tool
+// arguments or an advertised-name prefix. Annotations carry the tool hints from
+// that same trusted capability.
+type ResourceMetadata struct {
+	BackendID   string
+	Annotations *ToolAnnotations
+}
+
+// resourceMetadataKey is the unexported context key used by
+// WithResourceMetadata and ResourceMetadataFromContext.
+type resourceMetadataKey struct{}
+
+// WithResourceMetadata stores trusted resource metadata in ctx.
+func WithResourceMetadata(ctx context.Context, metadata ResourceMetadata) context.Context {
+	return context.WithValue(ctx, resourceMetadataKey{}, metadata)
+}
+
+// ResourceMetadataFromContext retrieves trusted resource metadata previously
+// stored with WithResourceMetadata. For compatibility, annotations stored with
+// WithToolAnnotations are returned when unified metadata has no annotations.
+// The second return value reports whether either metadata channel is present.
+func ResourceMetadataFromContext(ctx context.Context) (ResourceMetadata, bool) {
+	metadata, ok := ctx.Value(resourceMetadataKey{}).(ResourceMetadata)
+	if metadata.Annotations == nil {
+		metadata.Annotations = effectiveToolAnnotationsFromContext(ctx)
+		ok = ok || metadata.Annotations != nil
+	}
+	return metadata, ok
+}