Fluency is not authority
An agent may explain a policy well without being qualified to decide permissions or consequences. Natural-language capability should never be confused with platform authority.
The safest boundary is structural: the model can propose or prepare an action, while deterministic code validates identity, scope, preconditions, and approval.
Classify tools by consequence
Read-only discovery, reversible drafts, external messages, permission changes, moderation, financial actions, and deletion should not share the same approval path. Tool design should make consequence visible.
- Default to read-only tools.
- Require explicit approval near consequential execution.
- Use idempotency and audit records for state changes.
- Limit credentials to the smallest available scope.
- Make opt-out and deletion paths part of the product.
Design the refusal path
A useful agent must know when it cannot proceed. Missing evidence, ambiguous identity, stale state, and conflicting instructions should produce a clear handoff, not a guess.