A library configures an agent deployment so it can reach only approved catalog and hours APIs. What configuration practice does that reflect?

Configuring a library agent deployment so it can reach only approved catalog and hours APIs reflects constraining tool endpoints to approved civic integrations. Least privilege for agents means the deployment’s tool surface is an allowlist of needed systems—not a chat confirmation step that leaves the endpoint list unchanged. This configuration practice reduces blast radius if the agent is prompted maliciously or misrouted while still enabling legitimate holdings and hours lookups.

Requiring staff confirmation in chat before the agent submits catalog or hours requests does not enforce an endpoint allowlist; it adds a manual approval step while the agent could still reach any URL, so it is not the deployment constraint described. Retaining detailed audit logs of catalog and hours tool use for later usage review does not restrict which endpoints the agent can call; it only records what happened after the fact, so it is not the endpoint constraint the scenario describes. Rotating service credentials for catalog and hours integrations using automated vault renewal workflows is good credential hygiene, but it does not limit the agent to approved catalog and hours APIs; it only changes keys, so it is not the deployment restriction described.

Exam caveat: approved endpoints still need authenticated, scoped credentials—allowlisting a URL without proper auth is incomplete security. Operational check: attempt a call to a non-approved endpoint and confirm denial; verify catalog and hours calls succeed with non-admin credentials; scan prompts and config for embedded secrets before go-live.