An expense-reimbursement agent processes employee requests through a process_reimbursement tool. Company policy requires manager approval before funds are disbursed for reimbursements above $500. The agent handles hundreds of requests each day, and the threshold enforcement must be tamper-proof regardless of how the agent is prompted.
Which design ensures that the $500 approval threshold cannot be bypassed?
A The process_reimbursement tool accepts amount and details, and internally enforces the threshold: amounts <$500 are auto-disbursed and the tool returns a success confirmation; amounts >$500 cause the tool to create a pending approval request and return a status indicating manager review is pending. B The process_reimbursement tool accepts an approved_by_manager: boolean parameter. The system prompt instructs the agent to only set this to true after confirming that a manager has approved the request. A nightly audit script reviews all reimbursements where approved_by_manager was set to true. C Provide two tools: auto_reimburse (hard-coded limit of $500) and request_manager_approval. Include detailed system prompt instructions telling the agent to check the amount and call the appropriate tool. Add a PostToolUse hook that logs which tool was called for auditing. D Implement the threshold check in a PreToolUse hook that inspects the amount parameter before process_reimbursement executes. If the amount exceeds $500, the hook modifies the tool call to add a requires_approval: true flag, which the tool checks before disbursing. Show Answer Answer Explanation A trusted reimbursement tool must enforce the authorization rule itself before it disburses funds. By converting any reimbursement above $500 into a pending manager-approval request rather than a disbursement, the rule remains effective even if the agent is induced to issue an unsafe tool call. Model prompts, model-supplied approval fields, tool-selection instructions, and audit logs do not provide the same enforcement boundary. OpenAI’s API documentation also directs implementers to validate generated function arguments in application code before invoking a function.
Learn more
Community Discussion