Tool Permission

What is a tool permission?

A tool permission is an enforceable rule that determines whether an AI agent may access a tool or perform a particular operation. Permissions can depend on the authenticated user, agent identity, environment, resource, action type, arguments, time, or approval state.

The key word is enforceable. Telling a model “do not delete files” is an instruction. Removing delete access from its credentials or rejecting unauthorized delete calls is a permission boundary.

How it works

Permissions should be checked outside the language model at the point where a tool is exposed or executed. Common controls include:

• allowlists of available tools;
• read-only versus write scopes;
• resource-level access rules;
• limits on destinations, amounts, or record types;
• short-lived credentials;
• approval tokens for sensitive operations.

An agent may be allowed to draft an email but not send it, or search customer records only for accounts assigned to the current employee.

Simple example

A finance agent has permission to read invoices and prepare payment instructions. Payments above $500 require a valid human-approval token, and the agent has no permission to change bank-account ownership. Even if a prompt injection requests those actions, the execution layer denies them.

Tool permission versus guardrail

A [guardrail](/glossary/guardrail/) is a broad category of controls that can validate inputs, outputs, decisions, and actions. A tool permission is specifically an authorization rule governing access or operation.

A schema guardrail might reject a malformed amount. A permission check determines whether this caller may submit that valid amount for this account.

Tool permission versus sandbox

A [sandbox](/glossary/sandbox/) limits the execution environment and potential impact of code or tools. Permissions decide which capabilities are authorized. An agent can run inside a sandbox and still have excessive network permissions; it can also have narrow permissions without process isolation. Strong systems use both where appropriate.

Why it matters

Agents generate probabilistic decisions, so sensitive authority should not depend only on model compliance. Least-privilege permissions reduce the damage from mistakes, compromised inputs, and unexpected tool selection.

Permissions also improve product clarity: users can understand what an agent can read, change, or send. See [Tool Use in AI Agents](/tool-use-in-ai-agents/) for the full invocation loop.