An incident-response summarization agent should call the ticketing API only from an approved tool set. Which control best fits?

Allowlisting only approved tools so the incident-response summarization agent can call the ticketing API from that set alone is the access control that fits. Agent tool allowlists constrain which integrations an AI agent may invoke. An IR summarizer needs the ticketing API to read or update incident tickets; it does not need arbitrary runtime tool invention, workstation shells, or unconstrained discovery of every municipal API.

Directing the agent in the system prompt to prefer the ticketing API for case updates during triage fails because a system-prompt preference is only a suggestion the model may ignore or be talked out of; it does not technically restrict which tools the agent can actually call. Issuing the agent a scoped credential for the ticketing API for incident case updates fails because a scoped credential controls what the agent can do once it calls the ticketing API, but by itself it does not stop the agent from calling other, unapproved tools it may discover. Routing ticketing tool calls through a human approval step in the SOC chat workflow fails because an approval prompt is only as good as the reviewer's attention, and it still leaves the full, unconstrained tool universe available to request from rather than restricting the set of callable tools.

Exam caveat: Tool allowlists are the primary control when the stem says "only from an approved tool set." System-prompt preferences, scoped credentials without a tool restriction, and chat-based approval without a defined tool scope are excessive-agency distractors.

Operational check: Configure the IR agent with an allowlist that includes the ticketing API only (plus any other explicitly approved tools), attempt a non-allowlisted API call and a shell tool (blocked), confirm ticket summarization still works, and require review before any new tool is added to the allowlist.