Topic starter
06/06/2026 2:23 am
TL;DR: Agentic apps can misuse legitimate tools in harmful sequences, even when authentication and authorization pass, according to WorkOS. The missing control is not identity alone but invocation policy that validates arguments, tracks chains, and gates risky actions before damage compounds.
Editorial analysis by NHI Mgmt Group, based on content published by WorkOS: “Securing agentic apps: How to stop your AI agents from misusing their own tools”.
Key questions
Q: What breaks when agentic tools are authorised but invocation policy is missing?
A: Authorisation still allows the agent to use legitimate tools, but it does not prevent harmful combinations of calls.
Q: Why do tool calls need context-aware policy in agentic apps?
A: Because a safe tool in isolation can become unsafe in a specific sequence or with unsafe arguments.
Q: How should security teams decide when to block or approve an agent tool chain?
A: Start by blocking clearly dangerous patterns such as data exfiltration or destructive actions.
Practitioner guidance
- Implement argument validation at the tool boundary Define allowed parameters for each high-risk tool, reject unspecified inputs by default, and block calls that expand scope beyond the task.
- Add session-level chain analysis Track the order of tool calls within a session so database-to-file-to-email or similar patterns can be flagged before completion.
- Classify tool risk by reversibility Treat read actions as low risk, reversible writes as medium risk, and destructive actions such as deletes or external sends as high risk requiring approval.
Bottom line: Agentic tool misuse is a runtime control problem, not simply an identity problem, because valid permissions can still produce harmful outcomes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 4:03 am
Invocation policy is the missing governance layer for agentic apps: Identity and authorization tell you who may act, but they do not tell you whether the action path is safe. When trusted tools can be combined into harmful sequences, the control failure sits between permission and execution. Practitioners should treat that gap as a distinct policy domain, not a tuning issue in existing IAM.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.
A question worth separating out:
Q: What is the difference between tool authorization and invocation policy for AI agents?
A: Tool authorization asks whether the agent may call a tool at all and on which resource. Invocation policy asks whether the specific call, arguments, and sequence are acceptable in the current context. The first is an identity question, while the second is a runtime safety question about how the agent is using its approved access.
👉 Read our full editorial: Tool misuse in agentic apps exposes a missing policy layer