Tool permission boundaries
View full-size diagram ↗What it is
The rules that decide which tools an AI agent may call, with what arguments, and how far each call can reach before a human or the host system has to approve it.
How it works
The runtime around the model, not the model itself, enforces the boundary: scope limits which tools exist, an approval policy marks each call as auto-run, needs-confirmation, or forbidden, a sandbox caps blast radius, and a credential layer lets the agent act without seeing the secret.
A concrete example
A coding agent edits files in one project directory freely, but deleting files or running a shell command elsewhere needs confirmation, and it can never reach the production database because that credential was never in its sandbox.
Why it matters
As agents gain write access to real systems, the permission boundary is the main thing between a useful action and an expensive, irreversible mistake.
What people get wrong: Listing a tool in the prompt or telling the model to 'ask first' is not a boundary; model instructions are advisory, while a real boundary is enforced outside the model by the runtime, sandbox, and credential layers.