Agent security begins with tool boundaries

An AI agent becomes risky the moment it can act: call an API, write to a database, send a message or move money. Most of the attention goes to the model. Most of the exposure sits at the tools.

Why tools are the boundary that matters

A model’s output is shaped by everything in its context: the user’s request, retrieved documents, previous tool results. Any of these can carry instructions the model may follow. When the next step is a tool call, a manipulated decision inherits whatever authority that tool has.

That is why we treat every model-to-tool call as a privileged action. The question is not only “is the model safe?” but “what can this call do, on whose behalf, and who decided?”

A practical checklist

• Identity. Each agent runs with its own workload identity, not a shared service account. Actions are attributable to the agent and to the human or service that sponsored it.
• Scoped permissions. Credentials are limited to the task. An agent that drafts refunds does not also hold permission to approve them.
• Validated tool results. Content returned by a tool is untrusted input. It is checked before it can influence a further privileged step.
• Approval before consequential actions. The user sees the exact action, its side effects and the affected systems, then approves or rejects it.
• An activity log. Actor, delegated identity, action, scope, timestamp and result are recorded for every call.
• Stop and roll back. There is a way to terminate a run and, where possible, undo its effects.

Test it, don’t assume it

Controls on paper are not controls in practice. We test agents for direct and indirect prompt injection, tool misuse, excessive autonomy, privilege escalation and credential misuse, then retest after remediation. Findings are reported only where test evidence supports them.

Testing always happens under written authorisation, with a defined scope and rules of engagement.

Where to start

If you already have an agent in production, start with an inventory: which tools can it call, with which credentials, and which of those calls change something important? That list is your threat model’s first draft.