How to add a tool allowlist

Stop the model from calling tools you never intended to expose.

1. Register only approved tools with the model

2. On tool_call, verify name ∈ allowlist

3. Validate JSON args against schema

4. Reject and log unknown names

5. Red-team with “call delete_all” prompts

**Try the lesson:** `guardrails-in-code` in Lane D