> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Insufficient guardrails for tools

> The agent uses tools but is missing required safety guardrails on inputs or outputs.

The agent uses tools but is missing required safety guardrails on inputs or outputs.

## How to resolve

Secure the full tool-execution lifecycle by wrapping all agent actions with comprehensive guardrails and continuous oversight to prevent malformed or unauthorized requests. Here are a few core mitigation strategies:

* **Input guardrails**: Protect the entire interaction surface by enforcing strict schema validation, intent checks, and specialized safeguards such as jailbreak detection for chatbots, document sanitization for RAG pipelines, and structured validation for tool invocation.
* **Output guardrails**: Apply application-appropriate filtering for toxicity, policy violations, PII leakage, and hallucinations to intercept unsafe responses before they trigger downstream actions.
* **Human-in-the-loop**: Mandate explicit human approval for high-impact actions such as code execution or file writes to reduce the risk of irreversible or unsafe operations.

## Risk

**Governance/Compliance**

Based on the above standards, **the following guardrails are considered important for tool-using agents**:

1. **Input Jailbreak/Prompt-Injection Detection**
   (NIST MAN-2, OWASP LLM01)
2. **Output Moderation / Safety Filtering**
   (NIST MAN-2, ISO 23894, OWASP LLM03)
3. **Tool-Call Validation (schema checks, safe parameterization)**
   (OWASP LLM05, ISO 23894)
4. **Per-Tool Authorization / Permissions**
   (ISO 42001, NIST GOV-2)
5. **Human Confirmation for High-Impact Actions**
   (NIST MAN-2, EU AI Act Article 14 “Human Oversight”)
6. **Logging & Traceability for Tool Actions**
   (NIST MAP-3, EU AI Act Article 12)

Every major standard requires **input safety checks**, **output filtering**, and **safe, verified tool execution** when an AI system can trigger external operations.

**Security**

Agents that uses tools without comprehensive input or output guardrails—such as jailbreak detection or toxicity/policy filters—are highly vulnerable to manipulation. Without these checks, harmful prompts or unsafe model responses can directly trigger unintended tool actions. Even a single missing guardrail significantly increases the risk of unauthorized API calls, file changes, code execution, data leakage, or successful prompt-injection attacks.

## Explanation

Tools enable an agent to perform real-world actions, so even small mistakes can have significant consequences. Input guardrails (like jailbreak detection) help block harmful prompts before they reach the model, and output guardrails (like toxicity or policy filters) check the model’s responses before a tool is triggered. When either layer is missing, unsafe instructions—whether caused by bad input or model error—can pass directly to tools and execute immediately.

## Specifications

**Trigger**

* len(agent.tools) > 0 and
* critical guardrails are missing, e.g.,
  * missing jailbreak detection in input guardrails
  * missing toxicity/policy filters in output guardrails

**Severity**

* LOW

**Applies to**: Agent