Agents can use vector search to recall prior cases and discover relevant tools, but similarity must never grant capability. Tool records describe approved functions; policy filters determine which tools the authenticated agent may see; typed validation constrains arguments; execution-time authorization checks current state; and high-impact, irreversible, or ambiguous actions pause for human approval.
Store name, purpose, input/output schema, risk class, owner, version, environment, allowed principals, data scopes, side-effect classification, approval rule, and embedding of its description. Credentials remain in a secret manager and are resolved only by the execution service.
The tool server rechecks authorization immediately before the action. The model cannot mark its own action approved.
Retrieve prior cases as evidence, not instructions. Store outcomes, environment, version, reviewer, and applicability. A successful incident fix from last year may be dangerous in today's system. Prefer version-controlled procedural knowledge for repeatable workflows.
Test a semantically relevant but unauthorized tool, malformed arguments, stale approval, changed resource state, duplicate execution, prompt-injected tool output, network timeout, and partial side effect. Verify audit records contain policy and version IDs without secrets.
Threat-model this agent tool and memory design [paste]. Produce tool-catalog fields, policy filters, typed schemas, risk classes, approval matrix, execution-time checks, idempotency keys, compensating actions, audit events, and adversarial tests.
Verification contract: No model output may directly cause a high-impact side effect without code validation and the configured approval evidence.