AI agent tool curation: what it means for access control

TL;DR: AI agent tool curation can reduce tool-related LLM token usage by returning only the tools an agent is authorised to use, instead of exposing the full enterprise catalog, according to KeyRunner. The result is a smaller discovery surface and a governance model that shifts access control to policy time, not prompt time.

Editorial analysis by NHI Mgmt Group, based on content published by KeyRunner: “How Policy-Curated Tools Reduce LLM Token Usage and Improve AI Agent Governance”.

Key questions

Q: What breaks when AI agents discover tools at runtime instead of using hardcoded lists?

A: Hardcoded lists assume the tool set is stable enough to be embedded in code.

Q: Why do policy-based tool sets improve AI agent governance?

A: They move authorisation to discovery time, before the model can choose from the enterprise catalog.

Q: How do security teams know whether curated tools are actually helping?

A: Look for three signals: fewer tools returned per agent, cleaner audit trails linking policy to execution, and lower variance between the tools an agent is allowed to see and the tools it actually uses.

Practitioner guidance

• Define tool access by role and purpose Create named policies that map each agent to a specific business function, then allow only the tools required for that role.
• Filter tools before model discovery Return only approved tools at request time so the agent never receives the full enterprise catalog as available choices.
• Separate catalog size from authorisation scope Treat tool inventory growth as a governance issue and review whether newly added tools expand the agent’s discoverable surface unnecessarily.

Bottom line: AI agent tool curation narrows the discovery surface so an agent only sees the tools its policy allows, rather than the full enterprise catalog.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →