An agent should not be trusted with its own tools

When an agent can call tools, a wrong answer stops being a wrong sentence and becomes a wrong action: an email sent, a record changed, a payment requested. The model that decides to act is the same model that can be talked into acting badly, so it cannot be the thing that keeps itself safe.

The checks have to live between the agent and the tool, where the model cannot argue with them. One check is never enough, because each one catches a different kind of problem.

The first question is whether the tool is what it says it is. A tool description is text the model reads, which means it can carry hidden instructions. Scan it before the agent ever sees it. The second is whether the tool has changed since it was approved, because a tool that was safe on Monday can be quietly swapped by Friday. Compare it to the version that was signed off.

The third is whether a run of harmless-looking calls adds up to something harmful. Reading a file is fine. Sending a message is fine. Reading a secret and then sending a message is not. The fourth is a tripwire: plant values that no honest task would ever touch, and stop everything the moment one moves.

Then, for anything with real consequences, a person approves it. And all of it is written to a log that cannot be edited afterwards, so that when something does go wrong, there is a record a human can read instead of a guess.