Topic starter
11/07/2026 8:48 pm
TL;DR: Tool calling turns LLMs from text generators into systems that can act through authenticated tools, and Stytch’s episode with Arcade shows how orchestration, approval checks, and multi-agent handoffs make that possible. The governance problem is no longer model quality alone, but who can act, when, and under which policy boundaries.
Editorial analysis by NHI Mgmt Group, based on content published by Stytch: “Agent ready episode 5 with Arcade: tool calling, orchestration, & agent development”.
Key questions
Q: What breaks when an AI agent is allowed to call tools without strict scope controls?
A: The main failure is privilege expansion.
Q: Why do tool-calling agents change IAM and governance priorities?
A: They shift the control problem from login and model access to delegated action.
Q: How do security teams know if agent tokens are too permissive?
A: Look for tokens that are long-lived, reusable across services, or visible to the agent runtime itself.
Practitioner guidance
- Define tool approval points Map every side-effecting tool to a required approval step or policy interrupt before execution, including email, messaging, data access, and external posting.
- Separate intent from execution Keep LLM tool selection in the agent layer, but enforce validation, authorisation, and error handling in the runtime that actually performs the action.
- Treat handoffs as governance boundaries Document what context and authority move between specialist agents, and require re-authorisation when a handoff changes the scope of action.
Bottom line: Tool calling changes AI governance because action now flows through authenticated runtime decisions, not just model output.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:14 pm
Tool calling turns agent governance into an authorisation problem, not a prompt problem. Once an LLM can request actions through authenticated tools, the question changes from what the model says to what the surrounding system lets it do. That means the meaningful control point is the tool runtime, approval gate, and policy boundary, not the text response itself. Practitioners should treat agent execution as a governed access path.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should organisations do when one agent hands tasks to another?
A: Treat every handoff as a new trust boundary. The receiving agent should not automatically inherit every prior permission, because delegation can widen the blast radius unless context, tool access, and approval rules are re-checked at the boundary.
👉 Read our full editorial: Tool calling and orchestration are reshaping AI agent governance