The system decides, not the model. An AI agent can propose any tool call, but a layer outside the model must check each call against the agent's real permissions before it runs. Instructions in a prompt are advice that injected text can override. Permissions have to be enforced in code.
What complete mediation means
OWASP's excessive agency guidance names the principle complete mediation: enforce authorization in downstream systems instead of letting the LLM decide whether an action is allowed. Every request passes a check, every time, regardless of what the model says it intends.
This matters because a model's output can be unexpected, ambiguous or manipulated. OWASP defines excessive agency as the weakness that lets damaging actions happen when that output goes wrong, whatever caused it. A permission that depends on the model behaving is not a permission.
Prompt rules versus enforced rules
| Question | Prompt rule | Enforced rule |
|---|---|---|
| Can injected text change it? | Yes | No |
| Does it leave an audit trail? | Rarely | Yes, as allow or deny events |
| Does it survive a model change? | Not reliably | Yes |
| Is it testable? | Loosely | Yes, with a failing call |
Prompts still help. They reduce wasted attempts and set tone. They just cannot be the lock.
Where to enforce
- The downstream system, with an account that has narrow rights. This is the last line and cannot be bypassed from the model side.
- A proxy or gateway in front of the tool server, which checks identity, tool and arguments.
- The MCP server itself. The specification says servers must validate inputs and implement access controls.
- The client, which can prompt a person before sensitive calls.
Use more than one. A client prompt that the user clicks through is useful but not a boundary.
How to test it
Write three hostile checks and run them before launch. Ask the agent, in plain words, to call a tool outside its list. Embed an instruction in a document it reads telling it to use a forbidden tool. Try a permitted tool with a forbidden argument. In each case the call should fail at a layer you can name, with a log line.
What to do with the results
If a test succeeds, the control is advisory, not enforced. Move the rule down a layer. If a test fails at the right layer, record the evidence for your audit file.
Safeguard offers MCP Guardrail and agent identity for applying this kind of policy to agent tool calls, and you can run a free scan of your own repositories at gold.safeguard.sh/scan. Autonomous fix pull requests are off by default, and every category starts on Manual.
Quick check
Are system prompt rules useless then?
No, they guide behavior, but they cannot be your only control since injected text can override them.
Is a client approval prompt enough?
It helps for sensitive calls, but pair it with server side checks and a narrow downstream account.
Sources
Last reviewed: 19 October 2026.
