A permitting agent can call tools that touch case systems. What mitigation best limits blast radius if the agent is steered poorly?
Select an answer to reveal the explanation.
Short Explanation
If the agent gets confused, a sandbox with least privilege is the crash barrier—tools shouldn’t have the keys to the whole city. You can’t rely on detailed audit logging to contain blast radius; it only records what happened after the fact.
Full Explanation
When a permitting agent can call tools that touch case systems, the mitigation that best limits blast radius if the agent is steered poorly is sandboxing tool execution with least-privilege network and data access. Agentic municipal apps turn prompt manipulation or flawed planning into real writes and reads against case databases; unconstrained tools can exfiltrate records, modify unrelated cases, or call lateral APIs. Sandboxing constrains runtime (filesystem, network egress, reachable services), and least privilege scopes credentials and data partitions to only what each tool needs for permitting workflows. Together they ensure a confused or injected agent cannot freely reach the wider civic estate. This is core defensive engineering for tool-using civic AI: assume the LLM can be steered, and make the tool plane fail closed. Enabling detailed audit logging of tool invocations for review only records what happened after the fact; it does not sandbox execution or restrict network and data access, so it cannot contain a steered agent's blast radius—it's detective, not preventive. Adding more training examples might reduce how often the agent gets steered, but it doesn't bound what happens on the rare occasions it still is, which is what blast-radius limiting is for. Screening agent prompts with a content filter before tool use can be bypassed by clever injection and does not constrain what a tool can reach once invoked, so it does not bound the blast radius of a compromised call. The mitigation that actually limits damage regardless of how the agent gets steered is constraining the tools themselves—sandboxed execution with least privilege. Exam caveat: 'add more training data' or cosmetic options do not address tool-plane abuse; look for sandboxing plus least privilege when the stem focuses on limiting impact of poor steering. Operational check: run the permitting tools in a locked-down runtime with deny-by-default egress, scoped service accounts per tool, and integration tests that attempt out-of-scope API calls and confirm they fail.