How are you defining and testing boundaries for tool-using AI agents?

For people building or deploying tool-using AI agents: How are you defining and testing the boundaries they should never cross. I’m talking about agents that can do things like: - call tools - access customer/account data - update CRMs - send emails - issue refunds - browse websites - trigger workflows - hand off to other systems A lot of security discussion focuses on prompt injection, but I’m more interested in the cases where the agent is not obviously jailbroken. Instead, it gets convinced by the workflow context that crossing a boundary is justified. Examples: - a user claims to be the account owner and urgently needs a refund - someone pressures a sales agent to reveal discount rules - a recruiter agent is asked to share candidate information because it “sounds internal” - another agent/tool/email/browser page frames an action as already approved If you’re building or deploying tool-using agents, how are you defining and testing the boundaries they should never cross?