Tool Permissions
A clever prompt is not an access-control list. The model will try refund if it can see the tool.
Badge access to rooms. The intern's badge does not open the vault.
Visual Workflows
Start here — scroll inside each diagram frame to explore, then use + / − to zoom up to 200% if needed.
Overview
Scroll inside the frame to explore · use + / − to zoom up to 200%
Scroll inside the frame to explore · use + / − to zoom up to 200%
Call attempt
Scroll inside the frame to explore · use + / − to zoom up to 200%
Model asked. Runtime still decides.
Key Takeaways
- 1.Permissions decide who may run which tool — not the model. Read vs write vs irreversible (refund, delete, email)
- 2.Check permission in the runtime even if the model asked. Human-in-the-loop for high-impact writes.
- 3.Scopes on each tool. Filter the registry per user.
- 4.Re-check at execution. Irreversible actions need HITL.
- 5.Never trust the model as the only gate.
Learn elsewhere
- →Tool Validation
- →Security — Phase 20
Real Example
Scenario
Support intern can lookup_order. Only leads can refund. The model emits refund; runtime returns a permission error, not a chargeback.
What you would do
In Tool Calling & Function Calling, apply Tool Permissions to this scenario: Support intern can lookup_order. Identify the inputs, run the technique, validate the output, and note one thing you would monitor in production.
Commands
Commands to Remember
Runtime is the gateRead vs write vs irreversibleHITL for blast radiusLog denials
Cheat Sheet
Quick recap
quick ref- •ACL, not a prompt
- •Check at execute
- •HITL for writes
- •Hide tools you deny
Common Mistakes
- ✕Hiding a tool in the prompt but leaving the handler open
- ✕No HITL on refunds
- ✕Same tool list for admin and intern