Tool Governance
An agent with tools is an execution identity, not only a chatbot. Treat every exposed function like an API permission and govern functions individually.
Classify Functions by Effect
| Function type | Examples | Recommended default |
|---|---|---|
| Read | Search documents, list tickets, read calendar availability | Enabled when access is correctly scoped |
| Draft | Draft email, prepare report, propose ticket | Enabled or confirmation for sensitive content |
| Create | Create ticket, task, event, or internal record | Confirmation unless narrowly bounded and reversible |
| Update | Change CRM record, campaign, permission, or workflow | Confirmation |
| Send or publish | Send email, post message, publish content | Confirmation |
| Delete or destructive | Delete record, revoke access, overwrite production data | Disabled or exceptional approval |
| Financial or privileged | Change budget, purchase, deploy, change access | Explicit approval and additional provider controls |
Least-Privilege Design
- Enable only approved connection types at organization level.
- Prefer a narrow service account over a shared administrator credential.
- Share production connections with the smallest relevant team.
- Give the agent only the functions used by its documented workflow.
- Keep read and write functions separate so safe retrieval does not imply write access.
- Use provider-side scopes and policies as an additional boundary.
- Review tool assignments whenever the agent prompt, owner, or purpose changes.
Organization Overrides
Organization-level connection governance can disable a connection type or force a function policy. Use it to prevent individual connection owners from making sensitive functions fully automatic.
Examples of organization-wide rules:
- sending email always requires confirmation,
- deleting external records is disabled,
- reading approved analytics data is enabled,
- changing advertising spend requires confirmation,
- production deployment functions are limited to an operations team.
Review actual actions in Tool Executions and configuration changes in Audit Log.