Tool Restrictions

An agent with unrestricted `delete_database` or `send_email` tools is one injection away from disaster. Restrict tools to what the current task actually needs.

Tool restrictions are key cards that only open certain doors — the intern badge doesn't open the server room.

Scenario

Free-tier user agent exposes `search_kb` only; paid tier adds `create_ticket`; admin session adds `issue_refund` with $50 cap.

Solution

In Security & Guardrails, apply Tool Restrictions to this scenario: Free-tier user agent exposes `search_kb` only; paid tier adds `create_ticket`; admin session adds `issue_refund` with $50 cap. Identify the inputs, run the technique, validate the output, and note one thing you would monitor in production.

Do this before moving to the next module — reading alone is not enough.

Open the Code Walkthrough below and run it locally. Change one parameter related to Tool Restrictions (e.g. model, temperature, top_k, or tool name), observe the difference in output, and write 2–3 sentences explaining what changed.

Highlighted lines show where Tool Restrictions happens in the code.

1def tools_for_user(user):  # define a reusable function2    base = [search_kb, create_ticket]3    if user.tier == "admin":4        base.append(issue_refund)5    return base  # return the result6
7agent = Agent(tools=tools_for_user(current_user))  # key line for Tool Restrictions

• Treating Tool Restrictions as a black box without evaluation
• Ignoring cost and latency in production
• Skipping error handling for tool restrictions

Quick recap — the most important points from this module.