> For the complete documentation index, see [llms.txt](https://www.aicontrolarchitecture.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.aicontrolarchitecture.org/the-ten-pillars/12-pillar-tool-and-action-control.md). # 12 · Tool & Action Control **Control question:** *What can the AI do?* **Surface:** Do. *** ## Purpose This is the pillar that governs AI **as an actor.** Once an AI can call APIs, trigger workflows, update records, send communications, or move money, it is no longer producing suggestions, it is taking actions with real, often irreversible, effect. This pillar bounds what those actions can be, requires human authority for the consequential ones, and refuses to enforce any action it cannot contain or undo. *** ## Why it matters Everything before this pillar is about what the AI knows and recommends. This pillar is about what it *does*, and doing is where probabilistic behavior meets deterministic consequence. An agent that can call a tool it should not, at machine speed, thousands of times, is a categorically different risk from a copilot that drafts text. The blast radius of a single mistaken or injected action can exceed anything a human operator could cause, and it can happen faster than a human could intervene. This is the surface the [Core Thesis](/foundation/03-core-thesis.md) is ultimately about: deterministic authority handed to a probabilistic actor. *** ## Control objectives * **Allow-list** the tools and actions an AI may invoke, default-deny. * Require **approval or step-up** for high-impact actions before execution. * Never enforce an action class **without a defined containment or compensation path**. * **Log every action** with the requesting identity, inputs, and outcome. *** ## Requirements From the [Requirements Catalogue](/foundation/06-requirements-catalogue.md): | ID | Requirement | From | Boundary | | --------- | ------------------------------------------------------------------------------------ | ---- | -------- | | ACA-12-01 | The tools and actions an AI may invoke are explicitly allow-listed. | T2 | Verified | | ACA-12-02 | High-impact actions require approval or step-up before execution. | T3 | Enforced | | ACA-12-03 | No action class is enforced live without a defined containment or compensation path. | T3 | Enforced | | ACA-12-04 | Every action is logged with the requesting identity, inputs, and outcome. | T2 | Verified | *** ## Action classes Classify every action before deciding how to control it; the class sets the default treatment: ``` Class Examples Default ──────────────────────────────────────────────────────────── Notify post message, send alert allow / step-up by audience Draft draft email, draft ticket allow Create create ticket, create task allow / step-up Update update CRM, IAM, config step-up Delete delete record, remove access deny / step-up Execute run command, trigger workflow step-up / deny Externalize send outside org, expose data step-up / deny Privilege change access, modify role deny unless explicitly approved ``` Risk tier and [boundary source](/foundation/03-core-thesis.md) move these defaults; the class also drives which containment or compensation path must exist before the action can be enforced live. *** ## Key controls * **Action broker / mediation point**: route the AI's actions through a control point that decides allow / deny / constrain / step-up *before* execution (an API gateway, an action broker, or a governed tool proxy). This is the enforcement surface. * **Allow-listing & least action**: the AI may invoke only the tools and action classes its use case needs; everything else is denied. * **Approval & step-up gates**: high-impact actions pause for a human, or require elevated authorization, before they run. * **Containment precondition**: do not turn on live enforcement for an action class that has no rollback, compensation, or containment path ([pillar 16](/the-ten-pillars/16-pillar-containment-and-recovery.md)). Never enforce what you cannot undo. * **Agent-specific controls**: for agents that chain actions, bound the loop: step budgets, scope per task, and human gates on high-impact steps (see the [AI Agent Control template](https://github.com/ai-ankqush/ai-control-architecture/tree/main/templates/ai-agent-control-template.md)). * **Full action logging**: every attempted and executed action recorded for [monitoring](/the-ten-pillars/15-pillar-monitoring-and-evidence.md) and reconstruction. *** ## Tier guidance | | T1 | T2 | T3 | | ----------------------------------- | -------------- | ------------------- | ------------------- | | Action allow-list | If any actions | Required (verified) | Required (verified) | | Approval / step-up on high-impact | - | Recommended | Required (enforced) | | Containment path before enforcement | - | Required | Required | | Full action logging | If any actions | Required | Required | *** ## Evidence The [AI Tool & Action Control template](https://github.com/ai-ankqush/ai-control-architecture/tree/main/templates/ai-tool-and-action-control-template.md) and [AI Agent Control template](https://github.com/ai-ankqush/ai-control-architecture/tree/main/templates/ai-agent-control-template.md) capture the allow-list, the action classes, the mediation/approval design, and the containment preconditions. Boundary source reaches *Enforced* when an active mediation point blocks or gates disallowed actions inline, the strongest control in the architecture, and the one that most requires [pillar 16](/the-ten-pillars/16-pillar-containment-and-recovery.md) behind it. *** ## Standards crosswalk Maps to NIST AI RMF **Manage**, ISO/IEC 42001 operational controls, EU AI Act (human oversight and robustness for high-risk systems), and directly to OWASP LLM (excessive agency, insecure plugin/tool design) and the OWASP Agentic Top 10. See [`mappings/`](/standards-crosswalks/mappings-readme.md). *** ## Failure modes * An agent invokes a tool or action outside any allow-list. * A high-impact action executes with no approval and no way to stop it. * Live enforcement enabled on an irreversible action with no compensation path. * Actions that cannot be attributed or reconstructed after the fact. *** **Next:** [13 · Human Accountability](/the-ten-pillars/13-pillar-human-accountability.md) *Version 0.1.0 · Licensed under the terms in* [*LICENSE.md*](https://github.com/ai-ankqush/ai-control-architecture/tree/main/LICENSE.md)*.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.aicontrolarchitecture.org/the-ten-pillars/12-pillar-tool-and-action-control.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.