Because the combined permission set can exceed the task boundary even if each tool is acceptable on its own. One tool may provide access to content, another may change files, and together they can create an unsafe path that no single approval review would have flagged.
When safe tools stop being safe in combination
Legitimate agent tools become risky when they are composable. A tool that only reads data and a separate tool that only writes, approves, or executes can be harmless in isolation, but together they may let an agent cross a boundary the reviewer never assessed. The security question is not whether each tool is allowed, but whether their combined effect creates a new path to impact.
That shift matters because agent decisions are often made per tool, not per outcome. If the access review treats each capability separately, it can miss sequences such as read then modify, inspect then exfiltrate, or retrieve then execute. For agent systems, the effective permission set is the set of reachable actions, not the list of individually approved tools.
The practical test is whether the tool chain can turn a narrow task into broader authority. If a model can gather content from one source, transform it with another, and then act in a third system, the combined workflow may exceed the task boundary even if no single step looks excessive. That is why AI Agent Authorisation Guide is useful here: it treats agent access as a per-action question, not a one-time blanket approval.
Combination risk also appears when tools share state, tokens, or trust assumptions. A content tool may return data that becomes an instruction for a downstream tool, or a file tool may alter a prompt, config, or context that changes what the next tool can do. MCP Security Guide is relevant because tool routing, token passthrough, and gateway design can either constrain or amplify those chained effects.
Once a tool chain can move from information access to execution, the risk becomes harder to spot in review. The same set of tools can be safe for one workflow and unsafe for another, depending on whether the agent can pass outputs forward without reauthorization. That is why Zero Trust for AI Agents matters: verify the principal and the request at the moment of action, not just at session start.
Risk and Threat Considerations
The main risk is privilege amplification through composition. An attacker, or even an ordinary prompt path, can abuse one legitimate tool to prepare inputs for another, then use the combined path to reach data, state changes, or external actions that were never intended as a single granted capability.
Failure mechanism: The control review is done at the tool level instead of the workflow level, so the agent can chain benign permissions into an unsafe sequence, such as read, transform, then write or execute.
Impact: This can produce unauthorized file changes, data exposure, policy bypass, or downstream actions that appear individually approved but are collectively out of scope.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Combined tools can be abused to exceed intended agent actions. |
| ASI03 — Identity & Privilege Abuse | Risk arises when legitimate permissions combine into excess authority. | |
| ASI08 — Cascading Failures | One tool's output can trigger unsafe downstream actions in another. | |
| Recommendation — Constrain tool chains so each step is separately authorised and bounded. Apply least privilege and re-check authority before each consequential action. Break unsafe chains with explicit controls between agent actions. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Tool combinations can expand effective privilege beyond task need. |
| IA-5 — Authenticator Management | Tool chaining often depends on managed tokens or credentials. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Chained tool actions need logs to reconstruct combined behaviour. | |
| Recommendation — Limit each agent path to the minimum access needed for the task. Rotate and scope credentials so a single tool cannot amplify access. Log tool-to-tool transitions so unsafe chains can be detected and reviewed. | ||
| NIST Zero Trust (SP 800-207) | AC-6 — Least Privilege | Zero trust reduces trust in preapproved sessions that can chain tools. |
| Recommendation — Verify each action independently and remove standing trust between tools. | ||
| OWASP ASVS | V8 — Authorization | The issue is whether combined operations are authorised as a whole. |
| Recommendation — Validate that multi-step workflows require explicit authorisation for the full effect. | ||
| MITRE ATT&CK | T1218 — System Binary Proxy Execution | Legitimate tools can be chained to proxy malicious or unsafe actions. |
| Recommendation — Map approved tooling to abuse paths and monitor for proxy execution patterns. | ||
Practitioner Guidance
What to prioritise: Review the reachable action graph, not the individual tool catalog. The important question is which end states the agent can reach when tools are combined, especially where one tool can feed another without a fresh decision point.
What to verify: Confirm that every transition from read to write, from analysis to action, or from internal context to external side effect has an explicit policy check. If the only review is “this tool is allowed,” the control is too coarse for agent use.
Decision rule: If two tools together can create change beyond the original task boundary, treat that pair as a distinct authorization path and test it as such. Do not rely on the fact that each tool passed review independently.
Practitioner takeaway: The safest agent design is not a smaller tool list by itself, but a system where combined capabilities are bounded, rechecked, and attributable at the point where they become dangerous.