Securing agent tool calls
A practical checklist for least privilege, runtime policy, approvals, and auditability around autonomous actions.
7 min read·July 8, 2026
Assume model output is untrusted
Tool arguments originate from probabilistic output influenced by user input and retrieved content. Validate them as strictly as parameters arriving at a public API.
- Use narrow tools instead of generic HTTP or shell access.
- Validate every argument against a schema.
- Inject credentials only after authorization succeeds.
- Reject unknown fields and unsafe defaults.
Separate permission from policy
Permission answers whether an agent may use a tool. Policy adds contextual rules: an amount limit, an allowed region, a time window, or a requirement for human approval.
Keep evidence
Record the agent, tool, arguments, decision, policy result, and external response identifier. Redact secrets while preserving enough context to explain every consequential action.