Giving an agent access to a tool is also giving it a path to data or action. Production systems should treat permissions and secrets as part of the agent design.

Use least privilege

Give each agent only the tools and fields required for its workflow. Prefer a narrow “create support draft” capability over a general database tool. Separate read, suggest, approve, and execute permissions. Use server-side checks for every consequential action.

Keep secrets outside model context

API keys, passwords, session tokens, and private connection details belong in a secrets manager or protected server environment. The model should receive a safe tool result, not the credential used to obtain it.

Defend against indirect instructions

Retrieved documents, web pages, tickets, and tool results can contain irrelevant or malicious instructions. Treat external content as data. Validate destinations, restrict outbound actions, require confirmation for high-impact operations, and test prompt-injection and data-exfiltration scenarios.

Related resources: MCP security, prompt-injection defence, and audit trails.