How to Apply Threat Modeling Principles to LLM Tool-Calling Systems

As large language models gain the ability to call external tools, security researchers are urging developers to treat the context window as an untrusted input and apply least-privilege design principles. Each tool exposed to a model should be evaluated for what data it reads, what it modifies, and who has authorized its use. Credentials should be scoped per invocation rather than per deployment to prevent an agent from accumulating the permissions of all users it serves. Irreversible actions, such as deleting production data, should require out-of-band confirmation that the model itself cannot generate. Full tool-call payloads, not model-generated summaries, should be logged to ensure reliable audit trails during investigations.