A tool allowlist limits the capabilities available during an agent run. Trusted code can build the list from the caller's identity, role, task, environment, and current approval state, then expose only those tool contracts to the agent and reject every other invocation.
Allowlists reduce accidental and malicious capability use, but each allowed tool still needs narrow inputs, target validation, authorization, logging, and safe failure behavior. Broad tools can bypass the intended boundary even when their names appear on an approved list.
ELI5
A tool allowlist is a list of the tools an AI agent is permitted to use. Anything not on the list is blocked, which helps keep the agent inside the boundaries of its task.
For example, a research agent might be allowed to search documents and save notes but not send email or delete files. Each allowed tool still needs its own checks so a broad or badly designed tool cannot bypass the boundary.
How is a tool allowlist different from a prompt instruction?
An allowlist is enforced by trusted software, while a prompt instruction depends on model compliance and cannot provide a security boundary by itself.
Should every user receive the same tool allowlist?
No. The available tools should reflect the verified caller, role, task, data scope, and approvals instead of exposing unnecessary authority.
