01 / Principal and identity
Who acts, and what can the platform identify?
The running agent and the originating application user are distinct principals.
The application owns user and run context; the tool handler receives structured arguments.
- 01Originating task
- 02Agent or workload
- 03A function tool submits a vendor payment.
- 04Observed effect
02 / Action-time control
Where can an unauthorized effect be stopped?
Wrap the local function tool and protect the payment API itself.
Bind user approval, task, vendor, amount and expiry to one call.
Delegation constraint
An agent-as-tool handoff must not inherit payment authority merely because the parent can delegate work.
03 / Worked denial
Test a request outside the grant.
An agent may match invoices up to $5,000; it proposes $7,200 for a new vendor.
Adversarial verification
Invoke the same function tool first with a permitted vendor and then with a new payee. Confirm the local handler and payment service use the exact normalized amount and recipient from the decision.
04 / Review and responsibility
What should the audit trail prove?
Run ID, user, tool arguments, approval digest, decision and payment status.
Hosted tools and direct API access need separate enforcement paths; an SDK wrapper is not a universal control.
Platform primary source