What it means
An AI agent selects actions and invokes tools, services, or workflows to pursue a goal across multiple steps.
Why it matters
Once a model can act, errors become transactions: excessive authority, ambiguous goals, untrusted observations, and weak stopping rules can produce real harm.
Practical focus
- Define the approved purpose, accountable owner, users, operating environment, and acceptable risk for ai agents and tool use before implementation or procurement
- Implement least-privilege tools, explicit action schemas, approval gates, spending and rate limits, state integrity, and reliable stop controls through documented architecture, policy, configuration, and change control
- Collect tool-call logs, approval records, action-denial counts, budget use, state transitions, and rollback results and compare the results with approved requirements, risk thresholds, and expected outcomes
- Exercise this failure scenario as a planned test: an agent interprets untrusted content as an instruction and uses a privileged tool without human approval
Common mistakes
- Using the label ai agents and tool use without defining the exact system boundary, decision, data, and people in scope
- Treating a model response or vendor claim as sufficient evidence without testing the surrounding application and operating process
- Failing to preserve tool-call logs, approval records, action-denial counts, budget use, state transitions, and rollback results in a form that lets reviewers reconstruct decisions and changes
- Testing only the normal path and never rehearsing what happens when an agent interprets untrusted content as an instruction and uses a privileged tool without human approval
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: