Give agents tools with boundaries

Connecting a model to a tool lets it request an action. Your application still needs to decide whether that action is allowed, whether its arguments are valid, and how the result is recorded.

Treat retrieved documents, websites, and tool results as outside input. They can provide evidence, but they should not rewrite the application’s permissions. Keep credentials and policy enforcement outside the text the model controls.

Design the failure path before enabling writes. If a remote system times out after accepting a request, repeating the action may create a duplicate. Use provider receipts and explicit reconciliation where a safe retry cannot be established.