Tool permissioning is the practice of limiting what external actions an automated agent can perform. Instead of giving an AI system broad control, defenders scope each tool to a specific task, account, network path, or data set. A browser plugin may read pages but not submit forms; a file tool may inspect logs but not delete them; a payment or admin tool may require extra approval.
This matters because many AI risks come from action, not output. An agent that can browse, send requests, or use live credentials can cross boundaries, touch real users, or change systems if its permissions are too wide. Attackers may try to exploit that trust by steering the agent into unsafe calls, while defenders use least privilege, allowlists, human approval for risky steps, audit logs, and egress controls to keep automation contained.