A transit rider assistant must call service-alert and ETA tools but must never reach internal payroll APIs. What control enforces this?

A transit rider assistant that may call service-alert and ETA tools but must never reach payroll APIs needs tool-access controls that allowlist only approved rider-service APIs. The control works because agent capability is defined by the tools it can invoke; an explicit allowlist scopes the Foundry agent to rider-facing operational data and blocks lateral movement into HR/payroll systems even if prompts request it. Tool governance is the primary boundary between public transit assistance and internal administrative systems.

Adding system prompt guardrails that direct tool selection toward rider services fails because guardrails are guidance, not enforcement, and cannot technically block the agent from reaching payroll APIs through another path. Configuring content filters that redact payroll entities from rider chat responses fails because it scrubs sensitive text from outputs but does not limit which tools the agent can invoke, leaving payroll calls unblocked. Enabling API Management rate limits that throttle approved rider-service API calls fails because throttling only controls volume on already-approved calls and does not enforce a block on payroll API access.

Exam caveat: allowlists must cover URL hosts, operations, and identities—host-only lists can still permit dangerous methods on an approved host if APIs are broad. Operational check: register only ETA/alert tools on the rider agent, verify payroll calls fail closed, monitor tool-call destinations, and include a negative test in CI that attempts a payroll path and expects denial.