Implements defense-in-depth controls at an AI agent's tool-invocation boundary using tool allowlisting, least-privilege identity binding, NeMo Guardrails policy enforcement, human-in-the-loop approval, and audit logging. Use when hardening an agent that calls tools with real side effects (email, payments, file writes, code execution), mapping OWASP Agentic AI Top 10 controls, or bounding prompt-injection blast radius.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Implements defense-in-depth controls at an AI agent's tool-invocation boundary using tool allowlisting, least-privilege identity binding, NeMo Guardrails policy enforcement, human-in-the-loop approval, and audit logging. Use when hardening an agent that calls tools with real side effects (email, payments, file writes, code execution), mapping OWASP Agentic AI Top 10 controls, or bounding prompt-injection blast radius.
Authorized-use-only notice: This is a defensive skill. The controls below govern how an AI agent invokes tools/plugins. Deploy them on systems you own or operate. Test guardrail bypasses only against your own agent in a non-production environment.
Overview
Autonomous (agentic) AI systems decide which tool to call, with what arguments, and when, based on model reasoning over untrusted inputs. That makes the tool-invocation boundary the highest-risk control point in an agent: a single successful prompt injection or a poisoned tool can turn the agent into a confused deputy that deletes data, sends money, or pivots into connected systems. The relevant threat is MITRE ATLAS AML.T0053 (LLM Plugin Compromise) and the OWASP Agentic AI Top 10 classes for Tool Misuse, Excessive Agency, and Privilege Compromise.
The defense is layered, defense-in-depth governance of tool calls: (1) a strict allowlist of which tools the agent may call and with which argument shapes; (2) least-privilege identity binding so each tool call runs with scoped, short-lived credentials tied to the acting user/session — not a single god-mode service account; (3) policy enforcement at the call boundary (NVIDIA NeMo Guardrails dialog/flow rails and tool guardrails, or a deterministic policy wrapper); (4) human-in-the-loop (HITL) approval for high-impact actions; and (5) audit logging of every invocation for detection. This skill implements all five with verified, runnable patterns using NeMo Guardrails and a framework-agnostic Python policy wrapper.
When to Use
When building or hardening an agent that can call tools with real-world side effects (email, payments, file writes, infra changes, code execution).
When mapping OWASP Agentic AI Top 10 controls onto an existing agent framework.
When you need to bound the blast radius of prompt injection / tool poisoning.
When a compliance or governance requirement mandates approvals and audit trails for autonomous actions.
During an architecture review of an agent's tool layer.
guardrails_config/prompts.yml enforces a self-check that blocks injection and disallowed tool requests (the self check input/self check output flows are NeMo Guardrails built-ins driven by these prompts).
7. Audit, alert, and review
Every decision from steps 4-6 is logged with actor, tool, argument hash, and decision. Forward to a SIEM, alert on deny/require_approval spikes (a signal of injection), and periodically review which tools the agent actually needs to tighten the allowlist further.
