AI tool boundaries

Treat a model’s tool call like untrusted structured input:

1. Expose a narrow operation, not generic SQL or shell access.
2. Validate schema and semantic constraints in code.
3. Re-authorize using the current user/service identity.
4. Make side effects explicit and idempotent where retries are possible.
5. Return bounded results without secrets.
6. Log an auditable decision/action record.

Example tool shape:

{
  "name": "get_order_status",
  "description": "Return the caller-authorized status of one order.",
  "input_schema": {
    "type": "object",
    "properties": { "order_id": { "type": "string" } },
    "required": ["order_id"],
    "additionalProperties": false
  }
}

The description helps the model choose the tool; it is not access control. The server must derive tenant/user scope from trusted execution context rather than accept it from model arguments.