Tool Catalog

Definition

A tool catalog is the explicit, typed, reviewable set of actions an AI agent is permitted to take. Each entry declares what the tool does, what inputs it accepts, what it returns, and whether it reads or writes.

The defining property is exclusion: anything not in the catalog is unreachable. An agent cannot call a tool that was never declared, no matter how it is prompted.

Why it is the first artifact, not the last

Teams commonly build the prompt first, discover the agent needs a capability, add it, and repeat. The catalog then becomes an accumulated residue of past decisions rather than a designed boundary — and nobody can answer “what can this agent actually do?” without reading code.

Designing it first inverts that. The question “which actions should exist?” is a product and risk conversation that a domain owner can hold, and it produces an artifact a security reviewer can read in five minutes.

Convention versus enforcement

A tool catalog written as a list in a design document is a convention. It constrains the well-behaved case and nothing else.

It becomes an enforced boundary when a runtime refuses undeclared calls. On AWS, Bedrock AgentCore Gateway provides that: a single governed entry point for every tool an agent reaches, with authentication, customer-configurable rate limits, and Cedar-based fine-grained access control on writes.

The distinction matters most under adversarial input. A prompt-injected instruction can persuade a model to try a destructive action; it cannot make an undeclared tool exist.

What a good entry looks like

• Narrow verb. issue_refund(order_id, amount, reason) rather than update_order(order_id, patch). Broad, generic write tools are where blast radius hides.
• Read/write flag. Reads and writes should be visibly different classes, because they get different approval treatment.
• Explicit failure semantics. What the agent should do when the tool errors, so the loop does not retry a partially-applied write.
• An owner. A named person who approves changes to that tool.

When it is not enough

A catalog constrains which actions exist. It does not decide whether this caller, in this context may take one — that is authorization, and it belongs outside the model. Nor does it tell you whether the agent is any good, which is what agent evals are for.

Catalog, authorization, evals, human gate. All four, in that order.

Related terms

AI agent · Human in the loop · Agent evals · Model Context Protocol · Amazon Bedrock AgentCore