Here is an endpoint that looks fine in a first agent prototype.

def create tool = params [ :tool ]. constantize result = tool . call ( ** params [ :arguments ])

render json: result end

Enter fullscreen mode

Exit fullscreen mode

The model returns a tool name and some arguments. Rails finds the class and runs it. It's short, and it works in a demo.

It also gives the model the final say. If the agent reads a poisoned document, picks the wrong target or carries context over from another tenant, this endpoint runs the bad decision as it is.

In a security product the side effects are big. An agent can end a session, disable an account, isolate a machine, rotate a credential or change a cloud policy. I don't want the model to authorize any of that.

So in our product the agent only proposes. It sends a typed action request. Rails takes the tenant and the user from the authenticated session, looks the action up in its own list, validates the arguments, applies policy and saves the request.…