Proposed actions need two decisions
Security inspection and business authorization answer different questions before an AI-triggered tool runs.
Suspicious is not unauthorized
A security scan asks whether the proposed tool call resembles manipulation, escalation, exfiltration, or an unsafe sequence. Authorization asks whether this authenticated actor may perform this exact operation on this exact resource now. A workflow needs both answers.
Bind the proposal to application state
Do not allow the model to assert identity or approval inside natural language. Build tool arguments from typed data, validate them against current server-side state, and reject unknown fields.
- Security decision before execution.
- Identity and tenant authorization before execution.
- Business limits and approval policy before execution.
- Idempotent execution with an auditable result.
A useful failure mode
When either decision fails, the workflow should degrade safely: return read-only guidance, request clarification, or route the case for review. The refusal should preserve enough evidence to explain which control acted and why.