Complete the CrewAI Tool Guard
A support agent can look up orders and issue refunds, and the model deciding which to call reads customer email.
Deciding whether a model-requested action may run
The model does not execute anything: it emits a tool name and a set of arguments, and your code decides whether to honor the request. Read-only lookups can run immediately. Anything that moves money waits for a human. Network timeouts and loop repetition mean the same call will arrive more than once.
Your task
Complete ToolCallGuard.call one part at a time. Part one is in the brief below; the next arrives once its tests pass.
Pairing tasks
Part 1 — Make the call
Start simple. The model has asked for a tool by name with a bag of arguments. Reject the request if the arguments do not fit the schema, and otherwise run it and hand back the result.
- Reject a call whose arguments do not satisfy the schema, before anything else happens.
- Run a tool whose arguments are valid and return what it produced.
Part 2 — Hold what moves money
Now the refund tool is in the schema list. A read-only lookup can still run on sight, but anything with a side effect waits for a human. Do not let the ordering of your checks decide an unapproved refund.
- Hold a side-effecting tool for approval rather than executing it.
Part 3 — Make it safe to retry
Last part. Network timeouts and loop repetition mean the same approved call arrives more than once, and afterwards somebody has to be able to reconstruct what the agent did and why.
- Return the stored result when an idempotency key has already completed.
- Record every decision so a run can be audited afterwards.
Explain why the four checks have exactly one safe order, and identify which of them must hold even when the model is behaving perfectly.
Interviewer follow-up questions
- A retrieved document tells the agent to issue a refund. Which of your controls is still standing?
- Why is validating arguments before checking approval not merely an efficiency choice?
- What breaks if the idempotency key is the tool name and arguments rather than a caller-supplied key?
- Which of these checks would you keep if the model became twice as reliable?
Skills: CrewAI · Tool schemas · Least privilege · Idempotency · Agent containment