c5.8 Limit destructive operations and justify each tool
Assess which capabilities an agent truly needs and constrain mutative or destructive operations, so the agent's blast radius stays proportional to its purpose.
Implementation guidance
How to implement on AWS
Evaluate the tool architecture: for each capability, decide whether the value justifies the risk. Limit agent access to mutative or destructive operations, add extra controls (approval, tighter IAM) for high-impact actions, and remove tools the agent does not need. Authorize each tool call with AgentCore Policy (Cedar) at the gateway, which denies by default.
Acceptance criteria
Each agent tool is justified against its risk; destructive/mutative operations are restricted or gated; unnecessary tools are removed. A tool call with no permitting policy is denied.
Practical implementation
How this control is implemented in each reference architecture:
A documented tool-risk review in the Generative AI account keeps the agent's blast radius proportional: destructive operations are gated or removed, high-impact ones get extra controls.
- Review the agent's tool architecture: for each capability, decide whether the value justifies the risk, and remove tools the agent does not need.Generative AI account Bedrock AgentCore
IAM - Restrict access to mutative or destructive operations, and add extra controls (approval gate, tighter IAM) for high-impact actions.Generative AI account IAM
Step Functions - Use AgentCore Policy (Cedar) at the gateway to permit destructive or mutative tools only for the specific principals and input conditions that need them. The engine denies by default, so every other call to those tools is blocked.
- Record the justification for each remaining tool so the decision is auditable.Generative AI account
Amazon Bedrock
How to validate: Each agent tool is justified against its risk; destructive/mutative operations are restricted or gated; unnecessary tools are removed. A tool call with no permitting policy is denied.
Avoid: Giving the agent every tool 'in case it needs it'. Unused destructive tools are pure downside; justify each and drop the rest.
A tool-risk review in the account trims the agent to justified tools, gates destructive operations, and adds controls on high-impact actions.
- Assess each tool's value vs. risk and remove ones the agent does not need.Generative AI tier (IAM role) Bedrock AgentCore IAM
- Restrict destructive/mutative operations and gate high-impact actions with approval and tighter IAM.Generative AI tier (IAM role) IAM Step Functions
- Use AgentCore Policy (Cedar) at the gateway to permit destructive or mutative tools only for the specific principals and input conditions that need them. The engine denies by default, so every other call to those tools is blocked.
- Document the justification for each remaining tool.Generative AI tier (IAM role) Amazon Bedrock
How to validate: Each tool is justified; destructive operations are restricted or gated; unnecessary tools are removed. A tool call with no permitting policy is denied.
Avoid: An agent with broad write/delete tooling it rarely uses. Keep the toolset minimal and gate the dangerous parts.
Threats addressed
- An agent with unnecessary destructive/mutative capabilities.
- Resource exhaustion or damage from over-broad agent tooling.
AWS services
AWS IAM Framework mappings
OWASP GenAI/LLM Top 10 (2026)
- LLM03 Excessive Agency
- LLM06 Unbounded Consumption
NIST AI Risk Management Framework (AI 100-1)
- MAP.4 Risks and impacts are mapped
- MANAGE.1 AI risks are prioritized, responded to and managed
AWS Well-Architected Generative AI Lens (Security)
- GENSEC05-BP01 Implement least privilege and permission boundaries for agentic workflows
OWASP GenAI Top 10 for Agentic Applications (2025)
- ASI01 Agent Goal Hijack
- ASI02 Tool Misuse and Exploitation
Learning resources
References
- AWS SRA for AI — Capability 5, Application security