Function Calling Restriction

The core mechanism that defines an explicit, immutable list of approved functions an agent can call. Any tool not on the allowlist is rejected at the orchestration layer before execution.

• Default-Deny Posture: Blocks all functions by default; only explicitly registered tools are callable.
• Compile-Time Validation: The allowlist is defined in the agent's configuration, not in the mutable system prompt, preventing runtime injection from modifying it.
• Granular Scoping: Different agent instances or subtasks can have distinct allowlists, enforcing least privilege per workflow step.

Validates the arguments of a function call against a strict JSON Schema before execution. This prevents attackers from exploiting loose typing to inject malicious payloads or trigger unintended behavior.

• Type Strictness: Rejects calls where a string is passed to an integer field, blocking type-confusion attacks.
• Boundary Enforcement: Constrains numeric values to safe ranges (e.g., max_tokens cannot exceed a safe limit).
• Pattern Matching: Uses regex constraints on string parameters to block path traversal (../) or command injection characters.

Executes approved function calls in ephemeral, isolated environments to contain the blast radius of a compromised tool or a maliciously crafted parameter.

• Ephemeral Containers: Each tool invocation spins up a fresh, short-lived container with no persistent state or network access beyond its explicit needs.
• Filesystem Jailing: Restricts file system operations to a specific, temporary directory, preventing access to sensitive configuration files.
• Network Egress Filtering: Applies a secondary allowlist to outbound API calls made by the tool itself, preventing data exfiltration to attacker-controlled servers.

Requires explicit human approval before executing high-risk function calls, such as those that modify data, trigger financial transactions, or access sensitive records.

• Risk-Based Classification: Tags each tool with a risk level (e.g., read-only, mutating, destructive).
• Out-of-Band Confirmation: Sends approval requests to a separate, secure channel (e.g., Slack, PagerDuty) that an injected prompt cannot manipulate.
• Time-Bound Authorization: Approved actions carry a short-lived token, ensuring a compromised agent cannot replay an old authorization for a new, malicious purpose.

Scrutinizes the results of a function call before they are returned to the model's context window, preventing tool outputs from carrying secondary injection payloads.

• Content Filtering: Scans API responses for known malicious patterns or prompt injection syntax before the model can process them.
• Structured Output Stripping: If a tool returns a raw HTML or JSON blob, the gatekeeper extracts only the essential data fields, discarding any executable or markup content.
• Truncation & Clipping: Enforces a strict maximum length on tool outputs to prevent context-window stuffing attacks that aim to displace system instructions.

Monitors the frequency and pattern of function calls to detect and halt anomalous behavior indicative of a compromised agent or a runaway loop.

• Call Frequency Caps: Limits the number of times a specific tool can be invoked within a sliding time window.
• Sequential Pattern Analysis: Detects unusual call sequences (e.g., a read_file immediately followed by an http_post to an unknown domain) and triggers an automatic kill switch.
• Cost Guardrails: Enforces a hard budget on expensive API calls (e.g., LLM-as-a-tool), halting execution if a spending threshold is breached.

An architectural pattern that executes agent function calls in sandboxed environments to prevent a compromised model from directly affecting critical infrastructure.

• Runs tool execution in ephemeral containers or restricted processes
• Enforces network egress filtering per tool invocation
• Prevents lateral movement even if function calling allowlist is bypassed
• Commonly implemented via gVisor, Firecracker, or WebAssembly runtimes

A design principle that restricts an agent's access to tools and data to the absolute minimum required for a specific task, limiting the blast radius of a compromise.

• Scopes function definitions dynamically per session context
• Removes unused tool schemas from the prompt entirely
• Reduces the attack surface available to indirect prompt injection
• Implements just-in-time tool authorization rather than static access grants

A mitigation technique that constrains a model's generation to a predefined, machine-readable schema, making it difficult for attackers to inject free-form malicious commands.

• Uses JSON Schema or Pydantic models to validate function call arguments
• Rejects any output that deviates from expected parameter types
• Prevents parameter smuggling where attackers embed commands in string fields
• Enforced via constrained decoding or post-generation validation layers

The practice of securing the central control logic of a multi-agent system against injection attacks that could cascade malicious instructions to subordinate agents.

• Validates inter-agent function calls against a central allowlist
• Implements signed invocation tokens to prevent unauthorized tool requests
• Monitors for anomalous call patterns indicating compromised sub-agents
• Critical when one agent's function output becomes another agent's input context

The core mechanism of function calling restriction that inspects each argument value against type constraints, range limits, and regex patterns before execution.

• Blocks path traversal attempts in file system function calls
• Validates URL schemes to prevent SSRF attacks via webhook tools
• Enforces numeric bounds on financial transaction amounts
• Sanitizes SQL fragments in database query function parameters
• Rejects unexpected keyword arguments not defined in the tool schema

A security layer that intercepts and analyzes prompts and model responses in real-time to block injection attacks and enforce content policies.

• Inspects function call payloads before they reach execution handlers
• Detects obfuscated malicious parameters using semantic analysis
• Can rewrite or reject dangerous function invocations inline
• Provides an audit trail of blocked tool access attempts for security operations