Tool-Layer Controls

Tool-layer controls are governance mechanisms applied at the level of AI systems, platforms, and applications rather than at the data or model level. These controls manage how AI tools are deployed, accessed, and used within an organization, including user permissions, audit logging, usage monitoring, and integration policies. They matter for enterprise governance because they enable security teams to enforce consistent policies across diverse AI applications while maintaining visibility into which employees use which tools and for what purposes.

1 item

ResearchGlobal2026-09-05

Microsoft: Agentic Security Requires Tool-Layer Controls, Not Just Model Guardrails

Microsoft's Security Blog published guidance on June 30, 2026, arguing that security controls for AI agents must be applied at the tool layer rather than relying solely on model-level guardrails. The guidance covers allowlisting MCP publishers, inspecting tool metadata, applying data loss prevention at the tool call parameter level, and correlating telemetry across agent actions. It directly implicates third-party risk programs, DLP frameworks, and agent audit trail requirements.

agentic AI MCP DLP audit trails Microsoft tool-layer controls third-party risk