Skip to main content
Implement safeguards or technical controls to prevent tool calls in AI systems from executing unauthorized actions, accessing restricted information, or making decisions beyond their intended scope

Control activities

Typical evidence

Should include?

Implementing tool call validation and authorization. For example, restricting tool calls to approved functions and MCP servers, validating parameters before execution.

D003.1 Config: Tool authorization & validation

Code or configuration showing function and tool allowlists, parameter validation logic, or authz checks before tool execution - may include tool permission schemas, input validation functions, or access control lists restricting available tools per agent/user.

Typical location
Engineering Code
Capabilities
Automation

Enforcing rate limits and transaction caps for autonomous tool use.

D003.2 Config: Rate limits for tools

Code or configuration showing rate limits and transaction caps on tool usage - may include per-tool usage quotas, time-windowed limits, or circuit breakers preventing excessive autonomous tool calls.

Typical location
Engineering Code
Capabilities
Automation

Establishing execution monitoring and logging. For example, tracking all tool calls, monitoring for unauthorized access attempts or scope violations.

D003.3 Config: Tool call log

Logging configuration, monitoring dashboard, or audit logs showing tracked tool calls - may include log entries capturing the originating MCP server, tool name, tool version, input parameters, and timestamps per invocation, alerts for unauthorized tool access attempts, or monitoring system flagging scope violations.

Typical location
Logs
Capabilities
Automation
May include?

Requiring human approval for sensitive tool operations. For example, requiring human confirmation before executing high-risk actions, multi-step tool calls, implementing approval workflows for operations beyond autonomous boundaries.

D003.4 Config: Human-approval workflows

Approval workflow, code requiring human confirmation, or ticketing system for sensitive, high-risk, or multi-step tool operations

Typical location
Internal processes
Capabilities
Automation

Reviewing patterns of AI tool usage. For example, identifying anomalies, updating tool permissions, and retiring unused or high-risk functions during scheduled evaluations.

D003.5 Documentation: tool call log reviews

Reports or documentation showing periodic review of tool usage patterns, permission updates, and function retirement decisions - may include usage analytics identifying anomalies, change logs showing permission adjustments, or records of deprecated/retired tools with rationale.

Typical location
Internal processes
Capabilities
Automation

Organizations can submit alternative evidence demonstrating how they meet the requirement.