AI FLUENCY | AI AGENT ENGINEERING
AI Agent Tool Security: How Can AI Agents Use Tools Without Compromising Security?
An AI agent may request actions, but that does not mean it should access every system or every customer's data.
Understand → Apply → Build → Test
AIYING — Accomplishing with AI
🎬 Watch the Short Lesson
Discover least privilege, secure tool access, and how to test an agent's authorization boundaries.
1. What Is AI Agent Tool Security?
AI agent tool security means protecting the external functions, APIs, databases and systems that an agent can invoke.
It includes access control, tool selection, trusted identity, input validation, secrets management, and monitoring.
The agent can request an operation. Only the application or backend should decide whether it is permitted.
2. How Does Secure Tool Access Work?
Tool descriptions and prompts guide agent behavior. They are not substitutes for backend security enforcement.
Least Privilege
Provide an AI agent only the permissions needed to complete its assigned task.
For example, an order-status agent may need permission to read an authorized customer's order, but not to delete orders or issue refunds.
Authentication
Authentication establishes who is accessing the system using trusted credentials or session information.
Authorization
Authorization determines which specific resources and operations that identity is allowed to access.
Authentication asks: Who are you?
Authorization asks: What are you permitted to access or do?
3. Practical Applications
- Retail: Retrieve only the authenticated customer's orders.
- Finance: Separate read-only financial analysis from payment authority.
- IT Operations: Restrict destructive tools and system permissions.
- Human Resources: Protect employee records according to roles and access rights.
- Research: Limit agent access to confidential documents and data collections.
4. Industry Example: Customer Order Privacy
Illustrative scenario: A retail support agent receives a request to check the shipping status of order 1043.
The authenticated session belongs to customer_A.
However, order 1043 belongs to customer_B.
Security check: The backend compares the authenticated customer identity against the order owner.
Required result: Access is denied without exposing the other customer's information.
The system should avoid revealing whether the unauthorized order exists.
This is a fictional educational scenario, not a documented implementation by a particular retailer.
5. Build a Secure Order-Status AI Agent
Let's create an AI agent that can retrieve order information only when the authenticated customer is authorized to view it.
Prerequisites
- Python 3.10 or later
- OpenAI API access
- OpenAI API key
- OpenAI Agents SDK
Step 1: Install the SDK
pip install -U openai-agents
Step 2: Create the Python Agent
Save the following code as secure_order_agent.py.
"""
Educational demonstration:
Secure order-status AI agent.
All customer and order records are fictional.
"""
import asyncio
from dataclasses import dataclass
from agents import (
Agent,
Runner,
RunContextWrapper,
function_tool
)
# Trusted session information
@dataclass
class Session:
customer_id: str
# Fictional order database
ORDERS = {
"1042": {
"owner": "customer_A",
"status": "Shipped"
},
"1043": {
"owner": "customer_B",
"status": "Processing"
}
}
# Secure read-only tool
@function_tool
async def lookup_order(
ctx: RunContextWrapper[Session],
order_id: str
) -> str:
"""Look up an order for its authorized owner."""
record = ORDERS.get(order_id)
# Enforce access control in the tool itself
if (
record is None
or record["owner"] != ctx.context.customer_id
):
return "Order unavailable or access denied."
return (
f"Order {order_id}: "
f"{record['status']}"
)
# Create agent
agent = Agent[Session](
name="Secure Order Support Agent",
instructions=(
"Use lookup_order for order-status "
"questions. Do not guess statuses. "
"If access is denied, explain that "
"the order cannot be retrieved. "
"Do not claim refund or editing powers."
),
tools=[lookup_order],
)
async def main():
tests = [
("customer_A", "1042"),
("customer_A", "1043"),
("customer_A", "9999")
]
for customer, order in tests:
result = await Runner.run(
agent,
f"Check the status of order {order}.",
context=Session(
customer_id=customer
)
)
print(
f"Authenticated as {customer}, "
f"asked for {order}: "
f"{result.final_output}"
)
if __name__ == "__main__":
asyncio.run(main())
Step 3: Run the Agent
Configure the
OPENAI_API_KEY
environment variable securely.
Never place real API keys in your code.
python secure_order_agent.py
Expected Behavior
Test 1: Authorized Customer
customer_A requests order 1042.
Expected: Order 1042 — Shipped.
Test 2: Unauthorized Customer
customer_A requests order 1043.
Expected: Access denied.
Test 3: Unknown Order
customer_A requests order 9999.
Expected: Same generic denial.
Important Security Boundary
In this demonstration, the customer ID is supplied through application context.
In a production system, it must come from validated authentication middleware, not from an unverified user message or an editable model argument.
6. Test and Evaluate Your Agent
- Valid Access: Does customer_A successfully retrieve their own order 1042?
- Cross-Customer Access: Is customer_A denied access to customer_B's order 1043?
- Unknown Resource: Does an unknown order return the same generic denial?
- Social Engineering: What happens when a request tells the agent to ignore access rules?
- Least Privilege: Are refund, deletion and update capabilities absent?
Evaluation Criteria
- Authorized requests succeed.
- Unauthorized requests are denied.
- Private order information is not leaked.
- Unavailable orders do not reveal sensitive details.
- Tools enforce permissions independently of prompts.
Repeat the tests and inspect tool-level results as well as agent responses. Passing these introductory examples does not establish production security. The Python example was syntax-checked but not live API-tested.
7. Review Questions
- Why is a prompt instructing an agent to protect private records insufficient without backend authorization?
- What is the difference between authentication and authorization?
- Why should unauthorized and unknown orders produce similar external responses?
8. Interactive Quiz
Test your understanding of AI Agent Tool Security with five questions.
If interactive scripts are disabled, use the review questions above.
