LLMs, GenAI, RAG, agents, evaluation · insight-0631

Expose only the tools a task needs, as an explicit allow-list per route

Situation
One agent configuration registers every available tool (email, database, payments, file system) for all requests.
Action
Define an allow-list of tools per task type or user role, load only those into the request, and log any attempt to call a tool outside the list.
Reason
OWASP names excessive agency, giving an LLM system more capability than it needs, as a top LLM application risk; removing unneeded tools removes whole attack paths rather than hoping the model declines them.
Boundary
Assistants that serve several task types or user roles.

Symptom or risk

A misread instruction or an injected one can reach a powerful tool that the current task never required.

Sandboxed development agents without access to production data or external communication.

Fewer tools can block legitimate edge cases; route those to a human or a separate, approved flow.

Allow-listing in the prompt text only; enforce it in the code that executes tool calls.

OWASP's Excessive Agency entry (LLM06:2025) recommends minimising the extensions available to an LLM agent to those strictly needed.
LLM06:2025 Excessive Agency (OWASP Top 10 for LLM Applications)