Bound AI tools with explicit approval rules

An assistant with tool access can do more than generate text. It can retrieve data and potentially initiate changes. Derive its tool scope from the intended workflow, rather than exposing everything a connected system can technically perform.

Separate different kinds of action

• Distinguish reading from writing or triggering operations.
• Validate inputs and target objects on the server.
• Provide a reviewable preview and appropriate approval for consequential changes.
• Make results and aborted operations traceable through a business reference.

External content may contain misleading instructions. Such content must not alter the assistant's permissions. Even a correctly formatted tool call needs authorization against the actual user's rights.

Test prohibited requests as well as allowed workflows. The application should explain rejected steps and prevent subsequent actions from relying on an operation that never succeeded.