An agent can call tools that change production data. What is the right governance control for those tools?
Why B is the answer
Oversight modes and approval steps on those tool calls
Oversight modes and approval steps control what a tool call can do. Temperature has nothing to do with authorization.
In detail
- Actions that change production data need human control.
- Oversight modes and approvals stop them before they happen.
- Apply oversight per tool, by risk.
Use case
An illustrative scenario, not a real incident.
An agent can update customer records. Approval steps on that tool mean a person confirms each change, while read tools run freely.
See it in different ways
sequenceDiagram
participant A as Agent
participant H as Human
participant T as Refund tool
A->>H: Refund above the limit
alt Approved
H->>T: Run
else Rejected
H-->>A: Do not run
endflowchart TD
Q{"What does the tool do?"}
Q -->|"Reads data"| A0["Runs freely"]
Q -->|"Changes production data"| A1["Needs approval"]Key point: Actions that change data need oversight.
Why the other options are wrong
- A. A lower model temperature so the agent takes fewer risky actions
- Temperature does not limit risky actions.
- C. A larger context window so the agent remembers the rules for longer
- More memory is not a control.
- D. Leaving the tools out of the documentation that users can see
- Hiding tools from documentation does not control them.