SOLUTIONS · 04
Don’t let the model authorise its own tool calls.
When an agent starts a transfer, deletes a customer record or sends an email, the model makes the call and the organisation carries the consequence. Wardline evaluates every tool call before it runs: is the tool allowed for this agent, do the arguments match the schema, is the amount over the threshold, is there budget left in the session.
THE PROBLEM
A model is not an access control system
The tool list given to an agent is a suggestion. After an injection, or simply a bad plan, the model can call a tool that is not on the list, with arguments nobody expected. “Never exceed the transfer limit” in the prompt is not a control.
Some of the risk lives in the session rather than in a single call: an agent stuck calling the same tool in a loop, or a session that starts with “check the account balance” and drifts into “export all customers”. You only see that if you track the session.
HOW IT WORKS
Step by step
Signed agent catalogue
Which agent may use which tools is defined in a catalogue signed together with the policy bundle. A tool that is not in the catalogue is refused at the first step.
Argument schema
Arguments are validated against the tool’s JSON Schema: types, ranges, required fields, no extra fields. A call that does not match does not run.
Idempotency for destructive tools
Tools such as transfers or deletions require an idempotency key. The same key with different arguments is rejected as a conflict, so a model retry does not execute the operation twice.
Risk budget
Each tool has a cost in policy, and the session budget is debited atomically on every allowed call. When it runs out, policy chooses between refusal and approval.
Human approval
On REQUIRE_APPROVAL an approval record is opened and a webhook goes to the approver. Once approved, the application repeats the same call with a signed, single-use token bound to that call. The token cannot be reused or replayed with different arguments.
Session tracking
Agent steps (goal, plan, tool intent, tool result) are tied together with a session key. Loop detection and the semantic distance between the goal and the plan, which we call plan drift, feed into policy as signals.
DECISIONS
Which decision you get, and when
| Decision | When | Example reason code |
|---|---|---|
| ALLOW | The tool is in the catalogue, the arguments match the schema and the budget allows it: the call runs. | POLICY.RULE_MATCH |
| REQUIRE_APPROVAL | The amount or operation type is over the approval threshold: the call waits for an approver and is then retried with the signed token. | TOOL.FINANCIAL_THRESHOLD |
| DENY | The arguments do not match the schema, or the tool is not allowed for this agent: the call does not run. | TOOL.ARGS_INVALID |
| DENY | The session’s risk budget is spent and policy chooses refusal in that case. | AGENT.RISK_BUDGET_EXHAUSTED |
EXAMPLE
A transfer from a treasury assistant
A corporate banking assistant processes a client instruction and calls a transfer tool. The tool is in the catalogue, the arguments match the schema and an idempotency key is present. The amount is above the approval threshold in policy, so Wardline returns REQUIRE_APPROVAL and an approval request goes to operations. After approval the application repeats the call with the signed token, which is valid once and only for these arguments.
| Decision | REQUIRE_APPROVAL |
|---|---|
| Agent | treasury-assistant · session HMAC |
| Tool | start_transfer · schema valid |
| Idempotency | key present · no conflict |
| Approval | record opened · webhook sent |
| Reason codes |
|
| Flags |
|
| Risk score | 0.81 |
CONFIGURATION
What administrators control
Agent catalogue
Tools per agent, a JSON Schema for each tool and which tools count as destructive.
Approval rules
Which tool, amount or customer segment needs approval, and where the approval webhook goes.
Risk budget
A limit per session, a cost per tool and what happens when the budget runs out.
Passive protection
For applications that do not use the SDK, tool calls in model responses are inspected at the gateway; the agent identity comes from a header or the endpoint default.
RELATED
Capabilities that work alongside
See it on your own traffic.
In a demo session we walk through this flow with examples your security team picks, in the console’s evidence viewer.
Request a demo