Firewalls check source and destination. IAM policies check who is calling. EDR looks for known-bad binaries and behaviors. None of these check whether the agent's intent behind a tool call matches what it was supposed to be doing. You can have perfect network security and still have a complete tool misuse attack succeed.
MIT 01 — Least Privilege for Tools: Every tool gets only the access it needs for its specific purpose. Not the full API — just the scope this agent, for this task, legitimately requires.
MIT 02 — Action-Level Authentication: High-impact tool calls require explicit confirmation — either from a human or from a policy engine that verifies intent at invocation time.
MIT 03 — Execution Sandboxes: Tool calls that generate code or make external requests run in isolated environments with outbound allowlists.
MIT 04 — Intent Gate (Policy Enforcement): A middleware layer that validates the intent behind a tool call before it executes. Does this call make sense in context?
MIT 05 — Tool Budgeting: Usage ceilings — rate limits, call counts, cost caps — that automatically halt the agent when something looks like a loop or runaway invocation.
MIT 06 — Just-in-Time Access: Credentials and API tokens issued per-task and revoked immediately after use, so there's no standing access for attackers to abuse.
MIT 07 — Semantic Validation + Monitoring: Enforcing fully qualified tool names, detecting anomalous sequences, and logging everything with enough context to reconstruct intent post-incident.
Start with MIT 01 (Least Privilege) and MIT 02 (Action-Level Authentication). Together they address the most common root cause (over-privileged tools) and the highest-impact scenarios (destructive or financial actions). The others add depth.