An agent will be allowed to issue customer refunds. Which design is the safest?
Options
- Expose one narrow refund tool, validate its arguments in code, enforce amount limits and per-user permissions, require human approval above a threshold, and log every call (Correct option)
- Give it the full admin API and a prompt that says to be careful
- Let it decide freely and review the logs at the end of the month
- Run it with the permissions of the most senior employee so it never gets blocked
Answer
Expose one narrow refund tool, validate its arguments in code, enforce amount limits and per-user permissions, require human approval above a threshold, and log every call
Why
The model can be confused or manipulated by the text it reads, so safety must not depend on its judgement.
A narrow tool plus checks in ordinary code limits what any mistake can cost. Approval for large amounts keeps a person in charge of the risky cases, and an audit log lets you review and undo.
Principle: the agent gets the least authority needed for the job.
Remember
Limit the tool, check in code, ask for approval on big actions.