How do you secure AI agent tool calls?
AI agent tool calls should be inspected before execution. The control point should check the tool name, arguments, target resource, tenant, identity, data class, side effects, destination, and the trust level of the context that influenced the call. High-risk sinks such as exports, writes, shell execution, browser actions, payments, and webhooks should require policy approval or human approval.
- Inspect every tool call before it executes, not after.
- Check name, args, resource, tenant, identity, data class, and side effects.
- Weight the decision by the trust of the context that triggered the call.
- Gate high-risk sinks — exports, writes, shell, payments, webhooks — with approval.
What to check before execution
A tool call is a sink. Before it runs, evaluate the tool name, arguments, target resource, tenant, caller identity, data classification, and side effects — and whether the context that produced the call was trusted enough to authorize it. See MCP security for the tool-discovery angle.
Excessive agency and least privilege
Most agent incidents are excessive agency: the agent could do more than the situation warranted. Scope tool permissions tightly, require approval for high-blast-radius actions, and prevent untrusted context from expanding what the agent may do — the core of a context firewall.