How to Secure AI Agent Tool Calls

Securing tool calls means deciding who may run which tool with which credentials, and recording what happened. HazelJS focuses on fail-closed authorization — not marketing claims of “prompt injection proof.”

Practical controls

1. Curate capabilities with Skillgate — do not expose every OpenAPI path.
2. Authorize with Gatekeeper: allow, deny, or require-approval.
3. Approve sensitive ops via durable HITL (hazel approvals).
4. Store secrets on hazeld (hazel secret set).
5. Audit with run timelines.

import { AgentGatekeeper, fromFunction } from '@hazeljs/​agent-gatekeeper';

Use hazel gatekeeper validate|simulate|explain to inspect policies without executing tools.

Read next

• AI agent security
• Gatekeeper guide
• App security guide