Layer capabilities by risk instead of exposing every tool
The ability to call an API does not justify administrator-level access. Scope tools into read-only, draft, reversible write and high-risk action tiers.
- Read-only: customer, order, inventory and knowledge lookup
- Assistance: draft responses, summaries and recommendations
- Controlled writes: drafts, tickets and pending approvals
- High risk: payment, deletion, publishing and permission changes require confirmation
Use an integration layer between models and core systems
Do not let a model construct database statements or bypass business services. Expose validated tools around existing domain capabilities and handle input validation, authorization, idempotency, timeouts and errors consistently.
Tool responses should be structured and field-limited instead of sending complete customer or order records indiscriminately.
Design failure handling and human takeover into the workflow
Model timeouts, API failures, missing parameters, insufficient permissions and conflicting results need explicit states. Users should know whether an action ran, remained a draft or requires another person.
- Record actor, tool, parameter summary and result
- Use idempotency and replay protection
- Provide rollback, correction and human takeover