LLMs, GenAI, RAG, agents, evaluation · insight-0652
A schema-valid tool call can still be unauthorised, so authorise every call downstream
- Evidence type
- documented fact
- Difficulty
- medium
- Roles
- Applied AI, ML engineer
- Industries
- aviation, banking
Summary: situation, action, reason, boundary
Situation
Structured outputs or strict tool schemas guarantee well-formed JSON, and the team treats that as the safety check.
Action
After schema validation, check authorisation in the service that executes the call: does this user own the resource, is the recipient allowed, is the amount within policy? Deny by default.
Reason
Format and permission are separate questions. OWASP's excessive-agency guidance calls for complete mediation, with authorisation enforced in downstream systems rather than left to the model.
Boundary
Every tool that reads or writes user-specific or financial data.
Symptom or risk
A perfectly valid call transfers a booking to another passenger's account or emails an export to an attacker-supplied address.
Exceptions
Read-only tools over public information.
Trade-offs
Authorisation logic must be duplicated or shared with the non-AI paths of the application; share it.
Pitfalls
Passing user identity as a model-generated parameter instead of taking it from the authenticated session.
Lessons and concepts
Claims and their sources
OWASP's Excessive Agency entry recommends complete mediation, enforcing authorisation in downstream systems instead of relying on the LLM to decide whether an action is allowed.