Because each tool call often returns a full object, then the model pays to ingest that object again when it reasons over it. When agents re-fetch the same ticket or record across multiple steps, token cost compounds. The spend problem sits in retrieval design as much as in model choice.
Why raw tool integrations inflate agent cost
Raw integrations are expensive because they move a lot of data, not just a decision. A tool often returns a full record, JSON blob, or large object, and the model has to ingest that payload again on the next reasoning step. If the agent re-reads the same ticket, account, or document several times, the token bill compounds quickly.
That cost profile is usually a design issue, not a model-size issue. The expensive part is often repeated context assembly, redundant retrieval, and carrying unnecessary fields forward when the agent only needed a few attributes to decide the next action.
Where the spend really comes from
Three patterns usually drive the bill. First, the tool returns more fields than the agent needs, so the model pays to process unused data. Second, the agent does not retain a compact working state, so it re-fetches the same object on each step instead of carrying forward a short summary. Third, the integration lacks step-aware caching, so identical reads are repeated across a workflow rather than shared.
Raw tools also make cost unpredictable because the payload size varies by object and by step. One ticket may be tiny, while another contains comments, history, attachments, and nested metadata. The agent then pays proportional token costs even when the task only needs a small slice of that data.
That is why retrieval design matters as much as model choice. If you reduce payload width, limit repeated reads, and separate what the model must inspect from what the system can store or reference elsewhere, you usually get a larger cost reduction than switching models alone.
How to lower cost without breaking the agent
Design the tool contract around the decision the agent must make, not around the source system’s entire object model. A narrow response shape, field filtering, server-side summarisation, and stable object references all reduce the number of tokens the model has to reprocess. For agent patterns that need delegated access and per-action control, AI Agent Authorisation Guide is the clearest reminder that the cheapest safe access path is the one that limits both scope and repetition.
Reuse matters too. When an agent must revisit the same record, give it a compact state object or summary that can be updated incrementally instead of re-sent in full. Where access and trust boundaries matter, Zero Trust for AI Agents is useful because it treats each action as a fresh decision, which fits better with narrow, step-specific tool calls than with broad, standing access.
If the workflow spans multiple tools or multiple agent hops, the hidden cost is often duplication across the chain. In those cases, control the handoff format and avoid passing the same large object through every component. Agentic AI Security Guide is relevant because it frames tools, orchestration, and identity together rather than as separate problems.
Risk and Threat Considerations
Cost blowouts are not just a billing nuisance, they can become an availability and governance problem. When agents repeatedly fetch large objects, teams often respond by loosening controls, widening caches, or skipping review steps to keep latency and spend tolerable. That creates more exposure, not less.
Failure mechanism: The agent retrieves oversized objects or repeats the same fetches, so token usage scales with payload size and workflow length. If the same data is reintroduced into the prompt each step, the cost growth compounds and can push teams toward unsafe shortcuts.
Impact: You get higher run cost, less predictable latency, and pressure to weaken guardrails or bypass retrieval discipline. In practice, expensive integrations can also make otherwise useful agent workflows too costly to operate at production volume.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Raw tool calls can over-fetch and repeat expensive action contexts. |
| ASI03 — Identity & Privilege Abuse | Large repetitive tool access can widen agent authority and create costly overreach. | |
| Recommendation — Minimise tool output and constrain agent tool calls to the data needed for each step. Scope each agent action to least-privilege access and per-action decisions. | ||
| NIST SP 800-53 Rev 5 | SC-28 — Protection of Information at Rest | Compact storage and reuse of task state reduce unnecessary repeated exposure of retrieved data. |
| AC-6 — Least Privilege | The same discipline that limits access also limits oversized, repeated tool-driven exposure. | |
| Recommendation — Store only the minimum data needed for the workflow and avoid reprocessing full records. Limit each tool invocation to the smallest data set required for the next action. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Cost-efficient agent integrations depend on narrowly controlled access and reuse paths. |
| Recommendation — Restrict tool access and approvals to the minimum needed for each workflow step. | ||
Practitioner Guidance
What to prioritise: Measure cost per task, not just cost per model call. The key signal is how often the same object is re-read and how many tokens are spent on fields the next step does not use.
What to verify: Check whether each tool response is the smallest response that still supports the decision. If the agent only needs status, owner, and next action, do not ship comments, history, and nested metadata by default.
Decision rule: If the integration returns full objects repeatedly, redesign the tool contract before changing models. If the same record must be revisited, prefer a compact state, a server-side summary, or a reference plus selective refresh.
Practitioner takeaway: The cheapest agent is usually the one that reasons over a small, stable working set, not the one that has access to the biggest raw object stream.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org