Orchestration & Agentic Security · Agent Authorization, Delegation, and Continuous Enforcement
Fine-grained rules for tool use
Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and which parameter values it may supply.
OWASP AISVS v1.01, requirement 9.5.1
In plain English
Decide in policy which tools each agent may call and with which parameter values, and enforce that in the runtime. Allowing a tool is rarely enough. "May send email" and "may send email to anyone, with any attachment" are very different permissions.
What good looks like
- Policies list the allowed tools per agent and the limits on their parameters.
- Every tool call is checked against the policy before it runs.
- Anything not explicitly allowed is denied.
- Denied calls are logged.
How teams usually do it
- A policy engine such as Open Policy Agent or Cedar, called by the tool gateway on every request.
- Parameter rules such as recipient domains, path prefixes, amount ceilings, allowed SQL verbs and read-only flags.
- Giving each agent only the tools its task needs, which improves accuracy as well as safety.
Suggested evidence
- The policies.
- Gateway decision logs.
- Tests of denied tools and out-of-range parameters.
Common mistakes
- Allowing a tool without limiting its parameters.
- One general-purpose tool, such as "run shell command" or "run SQL", that makes the policy meaningless.
- Policies written into the system prompt.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.