The security of tools called by a model rests on the principle that its arguments are not trustworthy: they are validated, the tool's permissions are limited to the strict minimum, and sensitive or irreversible actions require human confirmation.
Example
A deletion tool refuses any identifier outside the user's scope, even if the model requests it.