# Agentic AI · the safe tool-use pattern we ship by default

> Agent systems are a security surface. The 4-layer pattern we ship by default for safe tool-calling: scoping, user-backed auth, audit logs, circuit breakers.

An agentic AI that can send email, edit a CRM, move money, or call shell · is a security surface, not a chatbot. The blast radius of a jailbreak / prompt injection multiplies by whatever tools you wired up. This is the 4-layer pattern we apply on every agent build.

## Layer 1 · Capability scoping

The agent gets tools that are the minimum it needs. Not 'send_email' in general · 'send_email_to_customer' where 'customer' is scoped to the current user's account. Design each tool as narrow as possible; any tool that could 'do anything' is wrong.

## Layer 2 · User-backed authorization

Every tool wrapper re-authorizes the current user. The LLM can call the tool; the tool checks 'is this user allowed to do X to Y'. Treat the LLM as untrusted caller logic · always.

```python
def safe_send_email(to: str, body: str, ctx: UserCtx):
    if to not in ctx.allowed_recipients:
        raise PermissionError(f"recipient {to} not authorized")
    if len(body) > MAX_BODY:
        raise ValueError("body too long")
    audit_log(ctx.user_id, "send_email", to, hash(body))
    return email.send(to=to, body=body, from=ctx.user_email)
```

## Layer 3 · Per-call audit logging

Every tool call · who, what, when, why (the prompt that triggered it), how much (tokens, dollars). Keep 90-day retention minimum for compliance + debugging. You'll need this for the first incident; not having it at that moment is the worst-case day.

## Layer 4 · Circuit breakers

Rate limit per user. Rate limit per tool. Global kill switch on misbehaviour. When MTTR (mean-time-to-revoke) of a compromised agent is < 10 minutes, the damage budget is bounded. When it's an hour, it isn't.

> If you can't answer 'what can the agent do that would materially hurt the business?' in < 60 seconds, you haven't scoped tools enough. Start by reducing surface, not by adding guardrails to a broad one.

## What to take away

- Agentic AI multiplies blast-radius. The 4-layer safe tool-use pattern we apply: capability scoping, user-backed authorization wrappers, per-call audit logging, circuit breakers with MTTR < 10min. Includes real code samples.

## Tags

AI, Agent, Security, LLM, Tool-use, ai-security

## We build this for clients

https://dfieldsolutions.com/en/services/ai-automation

## More from the lab

- https://dfieldsolutions.com/en/lab/llm-prompt-injection-playbook-2026.md — LLM prompt injection playbook · the 2026 attack surface
- https://dfieldsolutions.com/en/lab/ai-agent-pricing-what-autonomous-agents-cost-2026.md — AI agent pricing 2026: what an autonomous agent costs
- https://dfieldsolutions.com/en/lab/self-hosted-llm-vs-api-2026.md — Self-hosted AI or the API? When to run your own LLM in 2026
- https://dfieldsolutions.com/en/lab/en-prompt-caching-ai-agent.md — Why your AI agent leaks money: 6 prompt-cache wins

---

Source: https://dfieldsolutions.com/en/lab/agentic-ai-safe-tool-use-pattern
DField Solutions — Torony köz 5-1.a, 2120 Dunakeszi, Hungary — +36 20 722 0002 — dezso@dfieldsolutions.com
Booking: see https://dfieldsolutions.com/en/contact