Allowlisted Tools and Approval

Give capabilities, not a raw shell

An allowlist names the only actions that are permitted. Give the model narrow allowlisted functions such as read_file(path) or search_logs(pattern). Each function must validate its arguments and keep paths inside the workspace. Avoid a general shell(command) tool. Clearly separate read-only actions from mutations, actions that change data or systems.

Require human approval for deletion, deployment, credential changes, network calls, or executing generated commands. Show the exact proposed action and its target before approval.

Warning: Prompt injection can arrive through a log, README, ticket, or retrieved document. Tool policy must hold even when the model is persuaded to ignore instructions.