Even legitimate tools cause harm when an agent uses them in unintended ways, such as deleting data, looping on costly APIs or sending data to the wrong place.
- Scope tools narrowly, and check every call’s arguments against policy in a gateway outside the model.
- Bind approvals to the exact arguments, and set rate and cost limits for each tool.
- Log tool calls and alert on unusual sequences.
Guides on this site
Authorize agent tools outside the model
Bind each proposed action to the user, resource and approved arguments before allowing a tool to cause a side effect.
Contain prompt injection at the application boundary
Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.
Constrain MCP and multi-agent trust boundaries
Validate each connection and delegated action without treating a token for another service, a tool description, another agent or a state handle as authority.
Practice
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.