Secure the moment an AI agent can take action

Chatbot security protects text. Agentic AI security must also protect side effects: purchases, account changes, email provisioning, DNS writes, image spend and every other tool call that changes the world outside the model.

The five controls an action-taking agent needs

1. Scoped credentials

A general provider credential often carries account-wide authority. A safer AI agent API issues a narrow key with explicit scopes such as domains:read, media:generate or receipts:read. A missing scope fails closed instead of asking the model to exercise judgment.

2. Quote before execution

Every billable action should have a deterministic price estimate before it runs. The quote becomes a stable object with an expiration time, line items and an approval requirement. This separates “the agent wants this” from “the system is authorized to buy this.”

3. Human approval for risky actions

High-cost or difficult-to-reverse actions should pause. The approval should identify the exact quote, requested action, expected cost and requester. Approving a general conversation is not enough; authorization must bind to the action that will execute.

4. Spend caps and idempotency

Daily and monthly caps limit worst-case exposure. Idempotency keys handle a different failure mode: retries. Network timeouts can cause an agent to repeat a call even after the provider succeeded. Reusing one idempotency key prevents a retry from becoming a second purchase.

5. Proof receipts

An audit record should preserve the provider identifier, timestamps, quoted and actual cost, status, verification evidence and rollback guidance when reversal is supported. Receipts make incident review possible without reconstructing events from model transcripts.

A secure execution sequence

1. The agent requests a structured tool with a scoped key.
2. The API validates schema, scope, tenant and spending limits.
3. A quote records the intended side effect and expected cost.
4. Policy decides whether explicit human approval is required.
5. Execution uses an idempotency key and server-held provider credential.
6. Verification checks the external result.
7. A receipt records what happened and what can be reversed.

Test policy before granting real authority

A sandbox should exercise the same request, quote, approval and receipt shapes without making a real purchase. That lets a team test prompts, retries and error handling before a production plan enables provider-backed scopes. ToolCall Store’s worked quickstart demonstrates the flow, and the availability page distinguishes sandbox, available and beta capabilities.

Agentic AI security FAQ

What is agentic AI security?

It is the set of controls that limits what an agent can do, how much it can spend, which actions require approval and what evidence is retained afterward.

Should an agent receive direct provider keys?

Not by default. Use a scoped intermediary key so the agent receives only the tools and authority required for its task.

How do idempotency keys protect actions?

They let retries resolve to one logical action instead of repeating a purchase or other side effect.