Prerna Kakkar distinguishes flexible build-time tools from production runtime tools. Administrative and natural language SQL tools help developers explore and configure systems, but their broad powers require human review. Runtime applications should instead expose structured, deterministic tools with predefined logic and parameters.
Averi Kitsch explains how a confused deputy attackA confused deputy attack tricks a system with legitimate authority into misusing that authority on behalf of a less privileged requester. can make an agent misuse legitimate privileges to expose private dataData privacy governs how personal, confidential, or sensitive information is collected, used, shared, retained, and protected in AI systems.. The defense begins by separating user, application, and agent identities, then separating dynamic agent inputs from factual application constraints that the model cannot change.
Averi Kitsch shows how database tools become safer as connection details, write access, allowed datasets, output limits, SQL statements, and user identity move outside agent controlAn agent permission boundary defines and enforces which resources and actions an automated agent is allowed to use.. Custom semantic tools use prepared statements and simple inputs, while bounded or authenticated parameters bind verified user claims directly to the tool and support a zero trust runtime design.
Watch on YouTube
