Treat tools as authorized actions

A model suggesting a tool call is untrusted input, not authorization. The server defines the available tools, validates arguments, checks user permission, and controls credentials.

Read-only search may run automatically. Sending email, publishing, deleting, purchasing, or changing infrastructure should require explicit confirmation and an auditable action boundary. Use idempotency keys so a resumed or retried turn cannot repeat a side effect.

Threat-model a “delete project” tool and redesign it with preview, approval, narrow scope, and recovery.

Define tools as narrow actions with validated arguments:

const tools = {
  getOrder: async ({ orderId }, user) =>
    orders.findOwned(orderId, user.id)
}

The model may suggest the action, but trusted code authenticates the user and checks ownership. Log the tool name and outcome without storing unnecessary prompt data. Test invented IDs, another user’s ID, repeated calls, and provider timeouts.