Separate proposing from executing
A reasoning agent can propose a useful sequence of actions without being entitled to execute every action. Start with a tool inventory: what each function can read, what it can change, and whose data it touches. An inventory lookup and a refund approval should not inherit the same permissions merely because they share a conversation. Enforce user identity, tenant boundaries, and allowed operations in application code. Treat retrieved documents and tool responses as untrusted data, not as instructions that can expand the agent’s authority. Prompt instructions complement these controls; they do not replace them.
Validate inputs and confirm consequences
Define required fields, acceptable values, and useful failure responses for each tool. Validate the proposed arguments before checking business conditions such as ownership and approval scope. For payments, deletion, or external messages, show the exact proposed consequence and obtain confirmation. A vague instruction to continue should not authorize an open-ended chain of future writes. Where a write might be submitted twice, design an application-level idempotency mechanism and establish how long approval remains valid. Keep the approved payload separate from the model’s next response so a later generation cannot quietly change the action.
Bound the loop and record outcomes
Give each task a stopping condition, a tool-step budget, and a deadline. When a tool fails, return a clear state rather than encouraging unlimited retries. Test malformed arguments, denied permissions, duplicated calls, interrupted dependencies, and retrieved text that tries to redirect the agent. Record tool names, approval decisions, and redacted outcomes so an operator can explain what happened without exposing credentials or complete customer records. Finally, verify tool calling, streaming, and any required structured format against the confirmed model interface. This is a design guide, not evidence that a particular UBTL model or endpoint supports those features.