Agents And Tool Use medium
Your support agent can call `send_email`. Leadership requires a guarantee that no email goes to an external domain without human sign-off, even if the agent is manipulated by a prompt injection in a customer message. How should you implement this?
- A Add a system-prompt rule requiring the model to ask for confirmation in chat before calling send_email to an external domain.
- B Have a second reviewer LLM inspect each draft and approve it, since a separate model instance acts as an independent check.
- C Have the agent call a self_check tool that returns whether the action is risky before it proceeds to call send_email.
- D Enforce it in the host's tool executor: external send_email calls are held as pending until a human approves them.
Answer: D. Enforce it in the host's tool executor: external send_email calls are held as pending until a human approves them.
A guarantee has to live **outside the model**. The host's executor can deterministically hold matching calls for human approval no matter what the model was persuaded to do. A reviewer LLM (B) is tempting, but it is open to the same injection and is not a human sign-off. The tradeoff is added latency and reviewer workload. Model-based review is acceptable only for low-stakes, reversible actions where a miss is cheap.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- You are defining a 'schedule_meeting' tool for an agent. Which schema decision most reduces wrong or malformed calls?
- A model emits three parallel tool calls: `get_inventory`, `get_price`, and `get_shipping`. To cut latency, the host appends each result to the transcript as it arrives and immediately re-invokes the model. Runs start failing with malformed-request errors, and some produce hallucinated shipping costs. What should the host do?
- A team splits a coding agent into planner, coder, tester, and reviewer agents, and each receives the full transcript of the previous agent. The expected quality gains did not appear. Cost tripled, and the reviewer often fixates on approaches that earlier agents abandoned. When is a multi-agent split actually justified?
- A support agent should remember each customer's preferences across months of sessions. The team appends every past session summary to the system prompt. After six months, prompts exceed 80,000 tokens, latency has doubled, and the agent sometimes ships to an address the customer replaced weeks ago. What redesign fixes both problems?
- A teammate proposes splitting a single coding agent into five agents, arguing that more agents means smarter results. When is a multi-agent split actually justified?
- A data-analysis agent runs model-generated Python inside the same container as your API service. That container has database admin credentials in environment variables. A security review flags this as critical. What is the best mitigation?