Page 214 - CyberSecurityEssentialsEnglish

The last two are the ones most often left out, and they are the two that make the difference
between a demonstration and something an organization can run. Guardrails hold when the
model is deceived, because they sit outside it. Observability is what lets you answer the

question that follows every incident, which is not what the model thought but what the
system actually did.

FIGURE 5-6: WHAT A PRODUCTION AGENT IS MADE OF

What to notice: A missing component is usually where the failure appears, and the two most
often missing are the guardrails and the observability.

Source: Prepared by the author.

How an Agent Actually Calls a Tool
The mechanism deserves naming, because the whole discussion above rests on it. A model
does not reach into another system by itself. It is given a list of tools it may use, each

described by a name, a purpose, and the shape of the input it expects. When the model
determines that a tool is needed, it emits a structured request naming the tool and its
arguments, the surrounding application validates that request and executes it, and the result
is returned into the context for the next step. This is usually called tool calling or function

calling, and the description of each tool is its schema.

Two points follow from this that matter for governance. First, the model never executes
anything; the application does. Every real control therefore sits in the layer that validates

and runs the request, which is exactly where least privilege, allowlists, and approval gates
belong. Second, the list of available tools is a decision, not a given. Expanding it expands
what the system can do, and it should be treated as a change requiring review.

Tools reach an agent through several routes, and the distinction is practical rather than

technical. Some are built into the product, such as web search, a code interpreter, or file
search. Some are functions an organization writes itself against its own systems. Some arrive

213