Securing APIs and Tool Calls in AI Agent Systems
Agents turn data access into autonomous action. Prompt injection, excessive permissions and emergent tool chains break classic API defences. This piece lays out least privilege, two-way validation and replayable audit trails.
Why agents invalidate classic API security models
Conventional web and API protection rests on three unstated assumptions: a human operates the UI, permissions are settled once at login, and requests are independent. Agents satisfy none of them.
- Autonomous loops. One user instruction can trigger dozens of nested tool calls with causal dependencies. No single request looks anomalous in isolation.
- Standing credentials. To automate anything, agents hold API keys or tokens for long periods, so damage during the credential lifetime is hard to contain.
- Indirect prompt injection. The payload may never come from the user — it can sit in a web page, document, email or tool result the agent reads. By the time you notice, the action has already executed.
A five-layer framework
1. Tool inventory and least privilege. Explicitly register which tools the agent may call, which data each can read or write, and whether it touches money or irreversible state. Unregistered tools must be invisible. Reducing capability beats shipping a default-allow surface.
2. Two-way Schema validation per call. Inputs must match the contract to stop injected parameter tampering, and outputs must match too. Cloudflare API Shield provides Schema validation plus mTLS to reject unregistered call shapes at the edge, anchoring the boundary of your tool endpoints. Validate more than inputs: treat tool return values as untrusted input and validate or sanitise them again, because that is exactly the channel indirect injection uses to reach the context window.
3. Per-tool throttling and quotas. Risk differs enormously by tool: a weather lookup may run thousands of times a day, while a transfer endpoint may allow a handful and always with human confirmation. Cloudflare Rate Limiting rules can count by path, JWT claim or body content, so key throttling on tool name and risk tier. Otherwise an agent loop can destroy an expensive or dangerous endpoint in seconds.
4. Replayable end-to-end audit trails. Record full context for every tool call: the user instruction, the intent the model derived, inputs, outputs, and whether human approval was obtained. Auditing is not about blame; it lets you replay an incident and find the broken link before it escalates.
5. Model-side observability and cost control. Cloudflare AI Gateway centralises logging, rate limiting, caching and cost visibility for traffic to model providers, turning “how many model calls did the agent make and what did it cost” into governable metrics rather than a black-box invoice.
Suggested tool permission matrix
| Tool class | Data scope | Human approval required | Default quota |
|---|---|---|---|
| Read-only lookups (search, fetch) | Bounded index or tenant | No | Thousands per session |
| Internal reads (CRM, tickets) | Tenant-isolated | No, but logged | Hundreds per session |
| External writes (email, messaging) | Allowlisted recipient domains | Yes | Single digits per session |
| Payments and order changes | Per-transaction ceiling | Yes, with step-up confirmation | Very few per day |
| Infrastructure actions (config, deploy) | Staging only | Yes | Production disabled by default |
Caveats and where this does not apply
- Network-layer products cannot make business authorisation decisions. They confirm call shape, caller trust and rate, but “should this transfer happen” stays an application-layer judgement.
- Be cautious with fully unattended high-risk flows. LLM non-determinism means an occasional out-of-plan call even after extensive testing. Human-in-the-loop is mandatory around money and irreversible user data.
- Multi-agent systems amplify permission sprawl. Sub-agents inherit parent credentials, and cross-agent chains can create privilege combinations nobody granted. Issue per-agent credentials instead of sharing one master key.
FAQ
Does Schema validation remove the need to limit the tool set? No. Schema checks guarantee the call shape is valid, not that the capability should exist. A bloated tool surface makes wrong choices under ambiguity more likely, hurting both safety and reliability.
How do you defend against indirect prompt injection? Three layers together: contract-validate and sanitise tool outputs (strip instruction-shaped content), tag external content as quarantined before it enters the context, and require human approval for high-risk actions. Expecting one filter to solve it is unrealistic.
How should agent API keys be managed? One key per agent, scoped to its tool inventory, bound to an origin via mTLS or IP restrictions, monitored through AI Gateway usage logs for behavioural anomalies, and rotated automatically.
Is mTLS worth it for agents? Yes. It binds the caller to a certificate rather than a copyable string, which addresses credential leakage and caller spoofing at the transport layer. Deploy it alongside Schema validation.