agent-tool-action-boundary-reviewlisted

# Agent Tool and Action Boundary Review Review what an agent can ask a host to do and how deterministic controls constrain the result. Read [the tool action matrix](references/tool-action-matrix.md) when an agent has more than one tool or effect class. ## Preconditions Identify the agent, product user, service identity, registered tool inventory, data classifications, trust zones, and proposed effects. Obtain tool schemas and host policy from code or authoritative configuration rather than from model-visible prose alone. ## Workflow 1. Inventory every registered tool and action. Record owner, purpose, arguments, outputs, side effects, network destinations, data classes, credentials, and failure behavior. 2. Trace authentication and authorization from the human or system principal through the host to the downstream service. Do not treat the model as an approval authority. 3. Review schema constraints, canonicalization, allowlists, resource identifiers, object ownership, query limits, and server-side validation. Assume arguments can be manipulated. 4. Map read, compute, draft, external write, destructive, financial, publication, deployment, and trust-decision effects. 5. Review SSRF, confused-deputy, data-exfiltration, privilege-escalation, cross-tenant, and indirect prompt-injection paths. 6. For consequential effects, require durable external approval where appropriate, authenticated approvers, binding of approval to exact arguments, expiration, idempotency keys, replay