Agentic AI: designing the tool allowlist that bounds the agent

End-of-lesson check

15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-agentic-tool-allowlist-design-r7a1-creators

1. What ultimately determines the boundaries of what an AI agent can do?

   1. The amount of compute power available
   2. The natural language model it runs on
   3. The specific tools included in its allowlist
   4. The system prompt instructions it receives

2. A developer gives an agent a 'delete_anything(id)' tool that can delete any database record by ID. Why is this dangerous?

   1. The developer forgot to add rate limiting
   2. The tool name is too long and confusing
   3. The agent will eventually call this tool because it has access to it, regardless of intent
   4. The agent lacks permission to use the database

3. Which tool design principle most reduces the potential blast radius of an agent?

   1. Using narrow, intent-named tools like 'refund_order' instead of generic database tools
   2. Increasing the number of tools available
   3. Adding more detailed prompt instructions about when to use tools
   4. Training the model to be more cautious

4. A developer is creating tools for an agent that processes customer orders. Which example demonstrates proper narrow tool design?

   1. refund_order(order_id, amount)
   2. create_modify_delete_order(id, action, data)
   3. execute_query(sql)
   4. run_command(cmd)

5. According to the core premise of agentic tool design, where does agent safety actually reside?

   1. In the user's initial request
   2. At the tool boundary—the set of tools the agent can call
   3. In the system prompt's safety instructions
   4. In the model's internal safety training

6. A developer considers adding a tool that could cause significant harm if misused. What is the correct approach before adding it?

   1. Ask 'what is the worst single call this agent can make?' and address unacceptable outcomes
   2. Add the tool and monitor for abuse after deployment
   3. Refuse to add any tool that could possibly cause harm
   4. Trust that the model will refuse harmful calls

7. Why is giving an agent raw shell access equivalent to giving it unlimited power?

   1. Shell access provides a generic interface that can execute essentially any system action
   2. Shell access requires a confirmation step
   3. Shell commands are faster than API calls
   4. The agent can only run one shell command at a time

8. An agent keeps calling a tool that returns errors on every attempt. What will the agent typically do?

   1. Continue calling the tool since it has no inherent judgment about tool reliability
   2. Ask the developer for help
   3. Switch to a different tool that does something similar
   4. Stop calling the tool automatically

9. What can an AI agent do with the tools it has been given?

   1. Refuse to call tools that seem dangerous
   2. Create new tools that weren't originally provided
   3. Call them with parameters drawn from context, compose multi-step plans, and stop calling ones that error consistently
   4. Modify its own tool list based on what it learns

10. A developer creates four tools: 'rename_file(old_name, new_name)', 'delete_user(id)', 'send_email(to, subject, body)', and 'execute_sql(query)'. Which requires the most careful parameter scoping?

    1. rename_file because files are critical
    2. delete_user because it's irreversible
    3. execute_sql(query) because it can perform any database operation
    4. send_email because of privacy concerns

11. What limitation prevents agents from distinguishing between wise and reckless use of the same tool?

    1. Agents are too smart to make mistakes
    2. Agents can see the future
    3. The tools prevent this automatically
    4. Agents lack contextual judgment about consequences—they follow instructions, not wisdom

12. What does the term 'allowlist' specifically mean in agent tool design?

    1. A list of all possible tools that exist
    2. A list of forbidden words the agent cannot say
    3. A list of user-approved actions
    4. A list of explicitly permitted tools the agent may call, excluding everything else

13. Can an agent audit its own tool usage history without external help?

    1. Yes—agents automatically track all their actions
    2. Yes—but only for security-critical actions
    3. No—agents cannot audit their own tool history without developer assistance
    4. Yes—but only for actions from the past hour

14. Why is 'intent-named' a desirable property for agent tools?

    1. Intent names make the AI smarter
    2. Intent names are required by law
    3. Intent-named tools are faster to execute
    4. Names like 'refund_order' clearly communicate what action the tool performs

15. What happens when an agent receives parameters outside what a tool expects?

    1. The agent guesses what parameters to use
    2. The tool call returns an error
    3. The tool automatically converts the parameters
    4. The agent skips that tool entirely