Glossary · 6 · Quality, risk and governance
Tool allowlist (AI agent)
Also known as: Tool whitelist, Allowed tools
German: Werkzeug-Positivliste
A tool allowlist is the explicit list of tools, functions, MCP servers and parameter ranges an AI agent is permitted to call; every call that is not on the list is refused and logged, instead of being allowed until someone forbids it.
- Intermediate
- Developers
- Technical project managers
In one sentence
A tool allowlist names the only tools and parameters an AI agent may call. Everything else is refused and logged — deny by default.
Example
An IoT support agent may call “read device status” and “schedule firmware update for one device”, but not “update all devices” — a fleet-wide call is refused and raises an alert.
Explained in context
This term is a station of a mini course
- When an AI agent crosses the line: detect, contain and restore operationsStation: Scope, allowlist and own identityStart the course
Context cards connect this term with others to answer one question. Also in British English and German.
- Detecting an AI agent that crosses its boundaryHow do you notice that an AI agent has done something it wasn’t allowed to do — before a customer, an operator or the month-end report does?UKDeutsch
- Permission, capability, mandate: the three parts of an AI agent’s boundaryWhich boundary does an AI agent cross when it “goes too far” — and why does it matter which one?UKDeutsch
- When an AI agent crosses the line: detect, contain and restore operationsWhat has to be in place when an AI agent does something it isn’t allowed to do — in IT systems, IoT fleets, OT and on machines — and how is it detected, stopped and released again?UKDeutsch
How it applies
- Deny by default: The list says what is allowed; anything new — a freshly installed MCP server, an extra function of a connector — is blocked until it is added deliberately.
- Parameters, not only names: “Send email” with any recipient and “send email to the requester” are different tools. Allowlists constrain targets, amounts, device groups or setpoint ranges.
- Refusals are signals: A refused call is one of the clearest signs that an agent is leaving its boundary; log it and count it (see agent trace).
- Not a safety function: On machines and in OT an allowlist reduces what an agent can ask for. It doesn't replace limits in the PLC, the robot controller or the safety PLC.
Why it matters on your learning path
- Technical writers: The allowlist is a precise source for documenting what the agent can do.
- Technical marketers: Name the tools; “integrates with everything” worries security reviewers.
- Technical project managers: Treat additions to the list as changes that need a review.
- Developers: Keep the list in configuration under version control, not in the prompt.