AID-D-003.003: Agentic Tool Use & Action Policy Monitoring

Version 1.20261015 · Actionable sub-technique

Monitor the security decisions produced by the agent tool-enforcement layer, including denied tool invocations, parameter-schema failures, policy denies, and abnormal allow or deny bursts. Turn those enforcement outcomes into auditable telemetry and alertable patterns.

Pillars: app

Lifecycle: operation

Scope boundary

Owns detective monitoring of individual tool-action enforcement outcomes, parameter failures, policy denies, and abnormal decision bursts. It does not define capability scope, authorize an action, or execute a tool.

AID-D-003.004: AID-D-003.003 evaluates telemetry about each individual tool decision; AID-D-003.004 detects risk emerging from the order and composition of otherwise valid or invalid tool calls. A series can be suspicious even when each action is individually allowed, and one denied action does not establish a sequence anomaly.

AID-H-018.002: AID-D-003.003 monitors the decisions and failures emitted by runtime authorization; AID-H-018.002 evaluates policy and returns the canonical allow or deny result. The detector must observe enforcement outcomes without becoming a second authorization engine.

Implementation guidance

AID-D-003.003-G001

Consume and log tool-parameter validation failures from the enforcement layer before execution.
Concept:

Strict tool-parameter schema validation should be implemented by the enforcement layer defined in AID-H-018.001. This strategy focuses on the detection/monitoring side: capturing validation failures, denied executions, and suspicious parameter patterns so they become auditable security events.

Detection-Oriented Handling

When the schema enforcement layer rejects malformed, out-of-range, or policy-incompatible parameters, record the attempted tool name, calling agent identity, reason for failure, and relevant sanitized metadata. These events should be forwarded to SIEM/SOAR pipelines for alerting, trend analysis, and incident investigation.

{
  "event_type": "tool_parameter_validation_failure",
  "agent_id": "spiffe://prod.example/agent/order-assistant",
  "tool_name": "payments.create_refund",
  "reason": "schema_validation_failed",
  "details": {"field": "amount", "error": "maximum_exceeded", "schema_version": "payments-tool.v4"}
}

Action: Keep strict schema enforcement in AID-H-018.001. In this strategy, instrument monitoring so every validation failure or denied tool invocation becomes a structured, searchable security event before execution is allowed to proceed.

Verify safely

An independent verifier must fetch proposals and validation results independently, join them by immutable call ID, revalidate parameters against the signed schema and policy, and compare failure reasons and population gaps, read evidence back, verify signatures and digests, and compare the canonical result digest.

AID-D-003.003-G002

Log every tool decision (allowed and denied) to a central SIEM for audit and alerting.
Consume an authoritative decision receipt

The logger must observe the policy-enforcement result; it must not let an agent or request body choose ALLOWED or DENIED. Configure the receipt verifier and append-only sink at process startup. The verifier is an adapter to the policy engine's trust registry and returns a typed receipt only after checking its signature, freshness, policy version, and proposal/action digest.

Validate, minimize, and append one terminal event
from __future__ import annotations

# File: agents/tool_decision_logging.py

import hashlib
import json
from collections.abc import Callable
from dataclasses import asdict, dataclass
from typing import Literal

Decision = Literal["ALLOWED", "DENIED"]


@dataclass(frozen=True)
class VerifiedToolDecision:
    decision_id: str
    proposal_id: str
    tool_call_id: str
    tenant_id: str
    authenticated_principal_id: str
    agent_id: str
    tool_name: str
    action_sha256: str
    decision: Decision
    reason_code: str
    policy_id: str
    policy_version: str
    decided_at: str
    verifier_id: str
    receipt_sha256: str


VerifyReceipt = Callable[[bytes], VerifiedToolDecision]
AppendEvent = Callable[[dict], str]


def emit_tool_decision(
    *,
    signed_receipt: bytes,
    expected_proposal_id: str,
    expected_action_sha256: str,
    verify_receipt: VerifyReceipt,
    append_event: AppendEvent,
) -> dict:
    receipt = verify_receipt(signed_receipt)
    required = (
        receipt.decision_id, receipt.proposal_id, receipt.tool_call_id,
        receipt.tenant_id, receipt.authenticated_principal_id, receipt.agent_id,
        receipt.tool_name, receipt.action_sha256, receipt.reason_code,
        receipt.policy_id, receipt.policy_version, receipt.decided_at,
        receipt.verifier_id, receipt.receipt_sha256,
    )
    if not all(required) or receipt.decision not in ("ALLOWED", "DENIED"):
        raise ValueError("verified tool-decision receipt is incomplete")
    if receipt.proposal_id != expected_proposal_id or receipt.action_sha256 != expected_action_sha256:
        raise ValueError("tool decision is bound to another proposal or action")
    if len(receipt.action_sha256) != 64 or len(receipt.receipt_sha256) != 64:
        raise ValueError("tool-decision digest is malformed")

    event = {
        "schema_version": "aidefend.agent_tool_decision.v2",
        "event_type": "agent_tool_decision",
        **asdict(receipt),
    }
    event_bytes = json.dumps(
        event, sort_keys=True, separators=(",", ":"), allow_nan=False
    ).encode("utf-8")
    event["event_sha256"] = hashlib.sha256(event_bytes).hexdigest()
    acknowledgement_id = append_event(event)
    if not acknowledgement_id:
        raise RuntimeError("append-only decision sink did not acknowledge the event")
    return {
        "decision_id": receipt.decision_id,
        "event_sha256": event["event_sha256"],
        "acknowledgement_id": acknowledgement_id,
    }
Detect denial bursts without inventing a global threshold

Render the SIEM rule from signed environment policy using tenant_id, authenticated principal, agent, tool, event-time window, minimum denial count, and minimum distinct proposal count. Count unique decision_id values and require the exact proposal-to-terminal-decision population; missing or duplicate terminal receipts are telemetry defects, not low activity. Read events back by decision ID and compare the policy receipt digest before publishing a burst finding. This guidance logs and detects decisions; tool authorization and execution remain at their enforcement points.

Open-source tools

Commercial / hosted tools

Threat mappings

MITRE ATLAS

MAESTRO

OWASP LLM Top 10 2026

OWASP ML Top 10 2023

OWASP Top 10 for Agentic Applications 2026

NIST Adversarial Machine Learning 2025

Cisco Integrated AI Security and Safety Framework

Google Secure AI Framework 2.0 - Risks

Databricks AI Security Framework 3.0

AID-D-003.003: Agentic Tool Use & Action Policy Monitoring | AIDEFEND

Loading interactive view…

AIDEFEND™

A Practical Knowledge Base for AI Security Defenses

Version

GitHub MCP Service