Make AI chat agents useful—and bounded.

Start with the smallest action surface

Give your first agent one or two read-only tools rather than arbitrary code execution or unrestricted network access. Document tool inputs, outputs, error states and permissions.

Separate a recommendation from execution

The model can propose a tool call, but application code must check the user identity, intended resource, permitted operation and impact. Destructive or financial actions should require a separate confirmation step.

Defend the retrieval boundary

Webpages, emails and documents may contain prompt injection instructions. Their content should remain lower-trust data. Validate retrieved records and do not expose application credentials to model-visible outputs.

Budget and stop conditions

Cap tool calls per task, elapsed time, tokens, external requests and costs. Provide a graceful exit when the task cannot be completed safely.

Operational evaluations

Test invalid tool arguments, denied permissions, unavailable tools, ambiguous user instructions, conflicting evidence and malicious retrieved text. Review not only task success but also whether the assistant refused actions it should not take.

Follow the tool-call documentation and chat agent overview.