Agent and tool control

Before The Agent Takes Action

See explicit server allow-lists, scoped tool reachability, request inspection, recorded decisions, and supported human-review paths before a high-effect action proceeds.

What this answers

Transcript

An agent can be connected to a useful system in minutes. That does not answer the question that matters in production: which action is it actually authorized to take? A scheduling tool, a claims database, and an electronic health record do not carry the same consequence. If every connected tool is simply available, the agent's reach grows faster than the organization's ability to explain or constrain it. PrivacyFirst makes the tool boundary explicit. Meridian has approved three MCP servers: Claims DB, EHR Lookup, and Scheduling. The console shows whether each server is allowed, which tools are reachable, who made the decision, and when. A new server is not silently trusted. Key scope may tighten this workspace policy, but it cannot widen it. The team begins in monitor mode. Would-block decisions are recorded while calls continue, so operators can study real impact before they make a control disruptive. This is a deliberate graduation path, not a claim that every detector is equally certain. Deterministic findings may enforce the configured action. Model-classified findings remain monitor-only. Recent events show the difference in practice. A scheduling action was allowed. A claims-status query was monitored. An EHR patient-record call required approval. Each record names the server, tool, decision surface, and time without turning medical content into a dashboard. The security team can examine the exact governed action instead of inferring it from a generic agent log. Opening one event keeps the review narrow. The drawer preserves the tool identity and the reason the call reached this outcome. Argument and result inspection can be bound to an enforcement policy, while the server allow-list answers the earlier question of reachability. These are separate controls because a permitted tool can still receive an unacceptable payload. High-effect actions can be held for a human decision on the governed execution path. The approval is bound to that action, not a blanket permission for whatever the agent tries next. PrivacyFirst also states the boundary honestly: external MCP calls that cannot pause inline are not presented as if they can. The console shows what is pending and what can proceed. The result is a usable evidence chain: the server was explicitly allowed, the reachable tool set was bounded, the call was inspected, the decision was recorded, and a human approval was required where the path supported it. Authority over an agent becomes a visible operating model instead of a collection of permissions hidden in application code. Bring us one high-effect tool your A.I. agent needs to use. We will show the permission, inspection, and approval path before the action runs, together with the evidence your security team can review afterward. Book a live demo at PrivacyFirst dot A.I.