Capability Broker Pattern Limits AI Agent Tool Access to Declared Permissions Only

A software design pattern called a 'capability broker' is being proposed to improve security in AI agent systems by separating the model's ability to request actions from its ability to execute them. Instead of relying on the model to behave safely, all tool calls pass through a broker that checks each request against a pre-defined policy manifest before anything reaches the operating system or network. The broker can allow, deny, or flag a request for human approval, and logs every decision to a local audit table for accountability. Common risks — such as an agent combining a file-reader and a webhook poster to leak data via a malicious document — are mitigated because the policy, not the model's judgment, governs what is permitted. This shifts the security question from trusting the model's intent to verifying whether a specific call matches an explicitly declared rule, making safety auditable and testable.