Agent Tool and Action Boundary Review
Review what an agent can ask a host to do and how deterministic controls constrain the result. Read the tool action matrix when an agent has more than one tool or effect class.
Preconditions
Identify the agent, product user, service identity, registered tool inventory, data classifications, trust zones, and proposed effects. Obtain tool schemas and host policy from code or authoritative configuration rather than from model-visible prose alone.
Workflow
- Inventory every registered tool and action. Record owner, purpose, arguments, outputs, side effects, network destinations, data classes, credentials, and failure behavior.
- Trace authentication and authorization from the human or system principal through the host to the downstream service. Do not treat the model as an approval authority.
- Review schema constraints, canonicalization, allowlists, resource identifiers, object ownership, query limits, and server-side validation. Assume arguments can be manipulated.
- Map read, compute, draft, external write, destructive, financial, publication, deployment, and trust-decision effects.
- Review SSRF, confused-deputy, data-exfiltration, privilege-escalation, cross-tenant, and indirect prompt-injection paths.
- For consequential effects, require durable external approval where appropriate, authenticated approvers, binding of approval to exact arguments, expiration, idempotency keys, replay protection, and auditable result readback.
- Define cancellation, retry, timeout, duplicate delivery, partial failure, rollback, and emergency stop behavior.
- Test that unregistered tools remain unavailable and that skill text or retrieved content cannot expand the host tool registry or policy.
- Report findings without enabling, invoking, publishing, deploying, or changing a tool.
Routing Boundaries
- Use
application-security-review for conventional authentication, authorization, input handling, and data protection across the application.
- Use
agentic-system-security-review for the broader model, memory, retrieval, delegation, and supply-chain threat model.
- Use
api-contract-compatibility-review for producer and consumer compatibility rather than action authority.
Output
Return Decision, Tool inventory, Identity chain, Effect classes, Argument controls, Network and data boundaries, Approval and replay controls, Failure and recovery, Audit evidence, Findings, Required tests, and Authority still needed.
1---2name: agent-tool-action-boundary-review3description: Review the boundary between an agent and its registered tools or actions, including identity, permissions, schemas, argument controls, network reach, confirmation, idempotency, replay protection, rollback, and audit evidence. Use before an agent can read sensitive data or cause an external effect; use application-security-review for broader application controls.4license: MIT5---67# Agent Tool and Action Boundary Review89Review what an agent can ask a host to do and how deterministic controls constrain the result. Read [the tool action matrix](references/tool-action-matrix.md) when an agent has more than one tool or effect class.1011## Preconditions1213Identify the agent, product user, service identity, registered tool inventory, data classifications, trust zones, and proposed effects. Obtain tool schemas and host policy from code or authoritative configuration rather than from model-visible prose alone.1415## Workflow16171. Inventory every registered tool and action. Record owner, purpose, arguments, outputs, side effects, network destinations, data classes, credentials, and failure behavior.182. Trace authentication and authorization from the human or system principal through the host to the downstream service. Do not treat the model as an approval authority.193. Review schema constraints, canonicalization, allowlists, resource identifiers, object ownership, query limits, and server-side validation. Assume arguments can be manipulated.204. Map read, compute, draft, external write, destructive, financial, publication, deployment, and trust-decision effects.215. Review SSRF, confused-deputy, data-exfiltration, privilege-escalation, cross-tenant, and indirect prompt-injection paths.226. For consequential effects, require durable external approval where appropriate, authenticated approvers, binding of approval to exact arguments, expiration, idempotency keys, replay protection, and auditable result readback.237. Define cancellation, retry, timeout, duplicate delivery, partial failure, rollback, and emergency stop behavior.248. Test that unregistered tools remain unavailable and that skill text or retrieved content cannot expand the host tool registry or policy.259. Report findings without enabling, invoking, publishing, deploying, or changing a tool.2627## Routing Boundaries2829- Use `application-security-review` for conventional authentication, authorization, input handling, and data protection across the application.30- Use `agentic-system-security-review` for the broader model, memory, retrieval, delegation, and supply-chain threat model.31- Use `api-contract-compatibility-review` for producer and consumer compatibility rather than action authority.3233## Output3435Return `Decision`, `Tool inventory`, `Identity chain`, `Effect classes`, `Argument controls`, `Network and data boundaries`, `Approval and replay controls`, `Failure and recovery`, `Audit evidence`, `Findings`, `Required tests`, and `Authority still needed`.
JovaniPink