Security · agents

Check the action, not only the words: securing agent tool calls

Whatever the attack, it only does damage when the agent acts. Checking every tool call before it runs is the last point where a step can still be stopped.

Why the tool call is the place to check

Inputs can look harmless one at a time, and attackers keep finding new wordings. The action is concrete: a tool name and its arguments. “Send an email to archive@evil-mail.io with the transcript” can be judged against the policy whatever text led the agent there.

What to ask about every action

Check	Asks	Catches
Policy violation	Does this action break the policy?	Refunds over the limit, emails to outside addresses, forbidden commands
Goal misalignment	Does it serve what the user asked for?	Hijacked tasks: steps no one requested
Exfiltration	Is data leaving where it shouldn’t?	Transcripts, keys or records sent out through a tool
Your own rules	Whatever only your product knows	“The payment goes to a bank account not on file”

In Simo Guard these are checks you switch on or write yourself, and you can limit a check to the tools it is about.

Block, review, allow

Each check has two thresholds. At or above block, the call never runs. Between review and block, a person decides. Below review, it proceeds. Because the scores are calibrated, you set the thresholds from what a mistake costs: tight for payments and deletions, looser for read-only lookups.

pay_invoice(supplier="Northwind", amount=4800, iban=<new account>)

policy_violation   0.31   pass
new_payee          0.72   review   (review ≥ 0.40, block ≥ 0.90)

decision           REVIEW → sent to a person before any money moves

Wrap the tools once

Most agent frameworks end in the same place: “call tool X with arguments Y.” Wrap each tool so the check runs before the body, and every call path is covered, including the ones you didn’t anticipate. The developer docs show the one-line wrapper.

Keep limits in code too

Least privilege: a refund tool that refuses amounts over the cap; an email tool that can only write to the customer on file.
Read-only by default: give write tools only to agents that need them.
A person for the irreversible: use review thresholds to decide which steps wait for approval.

The guard catches the attempt and explains it. The code makes the worst case impossible.

Frequently asked questions

Does checking every tool call slow the agent down?

Simo answers in milliseconds, and every check is a question in the same read, so a full set of checks is one fast call per step. Calls with no applicable check skip the model entirely.

What if the guard is unavailable?

By default Guard fails closed: the step is blocked. You can choose to fail open, or handle the error yourself, per agent.