Tool Allowlist

An agent is not ready for production until it operates under default-deny tool access: no tool is callable unless explicitly added to an allowlist for the current task. If the agent calls a tool that is not on the contract, stop and treat it as a policy violation.

This is the privilege boundary. Without it, one prompt injection can escalate to arbitrary tool execution.

When to run

• Designing a new agent or multi-agent system
• Setting up production agent deployment
• Investigating "how did the agent execute that dangerous command"
• Implementing tool governance or audit requirements

If you cannot name the allowlist for this agent's current task, the agent is running with no policy.

The allowlist model

A tool allowlist is the explicit set of tools an agent may call for the current task. Everything else is denied.