Decide which tools your agents may call, and with what.
An agent is only as safe as the actions it can take. Swiftward governs the tools an agent may call, the parameters it may pass, and the systems it may reach. Deny by default. Allow on purpose.
What you control
- Per-tool allow and deny, so an agent reaches only the tools its job requires.
- Parameter bounds and schemas, so even an allowed tool cannot be called with dangerous arguments.
- A two-axis identity model: who is calling the tool, and what credential goes upstream to it. The agent never holds the keys it does not need.
- Hidden parameters injected by policy, so tenant and user scoping cannot be tampered with by the prompt.
Why permissions beat detection
Detection tries to catch a bad instruction. Permissions make the bad instruction harmless. If injection slips past every filter, an agent that simply cannot call the payments tool, or cannot pass an amount above a limit, does no damage. This is the layer that holds when the cleverness fails.