Prerna Kakkar distinguishes flexible build-time tools from production runtime tools. Administrative and natural language SQL tools help developers explore and configure systems, but their broad powers require human review. Runtime applications should instead expose structured, deterministic tools with predefined logic and parameters.
Averi Kitsch explains how a confused deputy attack can make an agent misuse legitimate privileges to expose private data. The defense begins by separating user, application, and agent identities, then separating dynamic agent inputs from factual application constraints that the model cannot change.
Averi Kitsch shows how database tools become safer as connection details, write access, allowed datasets, output limits, SQL statements, and user identity move outside agent control. Custom semantic tools use prepared statements and simple inputs, while bounded or authenticated parameters bind verified user claims directly to the tool and support a zero trust runtime design.
Watch on YouTube
