If an AI agent appears to use a forbidden tool, first determine whether it only proposed the call or whether the executor actually ran it. Then trace the call from the effective tool configuration through model selection, runtime checks and approval to the function or MCP server. Prompts and tool-choice settings influence what the model selects; authorization at the execution boundary is what must prevent an unwanted side effect.
Start by finding out what happened
An agent saying “I deleted the file” is not proof that a deletion occurred. A model may emit a tool-call proposal, a guardrail may block it, or the executor may run it and change a resource. These are different events, so use the executor or server’s records—not just the assistant’s text—to establish the outcome.
Capture the agent and run identifiers, configuration version, input, timestamp, model and tool events, proposed tool name and arguments, approval state, policy result, and executor or server outcome. There is no universal trace format established across frameworks; preserve enough information to connect the proposal, decision and any side effect.
Trace the restriction through the workflow
- Reproduce and capture the run. Save the evidence above before changing settings. Note whether the record shows a proposed call, a denied call, an approved call or an executed operation.
- Inspect the effective tool set. Check the runtime agent instance, inherited or cloned configurations, handoffs, delegated agents, dynamically loaded tools and environment-specific enablement. Do not rely only on the configuration file you expected to be active. For example, the OpenAI Agents SDK documentation notes that a cloned agent can share the original agent’s tool list unless a new list is supplied; a mutation can therefore affect both.
- Check tool-choice behavior. Find the actual setting used for the run. With
auto, the model decides whether to call a configured tool; other modes can require a tool, require no tool, or select a named tool where supported. A listed tool is not guaranteed to be used, and a model-level prohibition is not resource authorization. Check the API’s supported modes and constraints for your provider and version. - Inspect the proposed call. Verify the exact tool name, parsed arguments, target resource, caller identity and relevant policy context. Determine whether validation or approval interrupted execution, whether approval was accepted, and whether the tool implementation ran.
- Follow the call to its enforcement point. Check that the function executor or MCP server independently validates the caller, arguments and resource before performing the operation. A tool hidden from the model does not protect a path that other application code can invoke.
- Confirm guardrail coverage. Identify whether the call was a custom function, local MCP, hosted or built-in tool, or agent-as-tool. Check that the guardrail applies to that tool category and to every relevant agent in the chain.
- Classify the failure from the records. Determine whether the cause was an unwanted proposal, a missing or misconfigured restriction, a guardrail that did not cover the call, accepted approval, an executor authorization defect, or a blocked call mistakenly reported as executed.
Choose controls by where they enforce
| Control | What it does | Limitation to check |
|---|---|---|
| Prompt or natural-language instruction | Tells the model when it should or should not choose a tool. | Does not itself prevent execution if the model emits a call. |
| API or SDK tool choice | Can let the model choose, require a tool, require no tool, or specify a tool where supported. | Controls selection behavior; it is not authorization for a particular resource or operation. Supported values and constraints vary by API. |
| Runtime tool enablement | Can remove a tool from the model-visible set for a run or context. | A predicate evaluated before arguments arrive cannot authorize those arguments or their target resources. |
| Tool guardrail or approval | Can validate a covered call or pause it for review. | Coverage depends on tool type and workflow position; verify the actual path. |
| Function executor or MCP server authorization | Can enforce identity-, argument- and resource-level rules next to the protected operation. | Every protected execution path must enforce the rule, and denials must prevent the side effect. |
| Infrastructure boundary | Can constrain filesystem, network, identity or project access if application logic fails. | Requires deployment-specific configuration and independent testing. |
Where common SDK controls can fall short
OpenAI Agents SDK: distinguish tool choice from authorization
The Python Agents SDK documents auto, required, none and named-tool choices. Its tool list does not guarantee that the model will call a tool. Tool definitions can also be enabled or disabled per run; a disabled tool is hidden from the model. These controls shape the model-visible choices, but protected operations still need authorization at execution.
Recommended Free Tools
The Python SDK’s guardrail workflow has distinct boundaries: input guardrails run on the first agent, output guardrails on the final agent, and tool guardrails on guarded function-tool calls. Do not assume an agent-level check covers every delegated call or hosted and built-in execution tool. Check the documented coverage for the exact tool and workflow.
JavaScript enablement predicates run before arguments are known
In the OpenAI Agents SDK for JavaScript, isEnabled is evaluated while preparing the model-visible tool set, before the model supplies arguments. It can be useful for deciding whether a tool is available in a context, but it cannot by itself authorize an argument-specific action or resource. Put those checks in execution, a tool input guardrail, or the MCP server.
Approvals and denials do not prove execution
An approval mechanism can interrupt a run until a call is approved or rejected. A denied proposal may also return an error to the agent, after which the run continues. Anthropic’s managed-agent documentation describes that behavior for server-executed tools: under its auto policy, a server may run, deny or pause a call; denial returns an error tool result and cannot be overridden by the client. That policy does not apply to custom tools executed by the application, which must be controlled there. Verify current API and version support before relying on these Anthropic-specific details.
Put sensitive-operation checks next to the side effect
For any operation that changes data or reaches a sensitive resource, validate the proposed target, action, arguments, caller identity and scope immediately before execution. Pause ambiguous or high-risk calls for explicit approval. OpenAI’s Guardrails and human review guide specifically recommends putting validation next to a side-effecting tool rather than relying only on agent-level input or output guardrails in a manager-style workflow.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Keep independent infrastructure boundaries for filesystem, network, identity and project access. Application checks and model-visible restrictions can be misconfigured; infrastructure limits reduce what a faulty path can reach.
Test that denials prevent side effects
Test at the boundary that controls execution, not only by asking the model to obey a prompt. Include disallowed tool names, out-of-scope arguments, unauthorized resources, missing approvals and unavailable policy services. For each case, confirm both that the policy denies the request and that the protected operation did not occur. If a review or authorization service is unavailable, fail closed rather than running the operation without a decision.
- Use executor or server logs to confirm whether a side effect occurred.
- Test delegated agents and alternate application paths that can reach the same operation.
- Check the outcome when approval is rejected and when policy review cannot complete.
- Retain records of both the policy decision and execution result so a denial is not confused with a completed action.
Use framework-specific documentation for the exact path
Tool behavior differs by provider, SDK version, tool category and execution environment. Before applying a framework-specific fix, identify those details and consult the current official reference. The linked documentation covers OpenAI Agents SDK agents and tool choice, Python tool enablement, approvals and guardrails, Python guardrail workflow, the OpenAI API guide to guardrails and human review, the JavaScript tools guide, and OpenAI’s API tools guide. For Anthropic’s server-executed tool policies, consult its managed-agent tools permission documentation and verify that the behavior is supported by the API version in use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
