- Sam, CTO at Gravity, argued that agents are built to please, so any tool they can reach is a tool a user can talk them into using.
- He said written policies are not read at runtime, so limits must be enforced in the infrastructure, such as a gateway.
Sam, CTO at Gravity, made a blunt point on the AI Engineer show. AI agents are built to be helpful, and that helpfulness is a risk. Every tool an agent can reach is a tool a user can talk it into using. Sam argued that written rules cannot stop this. The limits have to be enforced outside the agent, in the infrastructure.
What was said
Sam ran a live demo with a hotel-booking agent. He ran two versions side by side. One kept its limits in its prompt and instructions. The other had a tightly scoped identity and a gateway in front of it. A gateway is a checkpoint that every request passes through.
He asked both to delete one booking and also to run a tool that deletes all bookings. The first agent did both. Sam said the tool was available and the user had permission to use it. The database then showed every booking gone.
The hotel's policy said not to use AI for this. Sam's verdict: "The agent doesn't care. Like, at runtime, no one reads those documents." His explanation for the behaviour was simple: "AI is really helpful. Like it wants to please. It wants to give you what you want."
The second agent found the same tool. The gateway refused the call with a "forbidden" error, and the agent did only the part it was allowed to do. A second demo asked for guest emails and card details. Again the first agent handed them over, and the gateway blocked the second. Sam noted the data was mocked.
He also tied tool count to risk. His own CRM exposes 64 tools through one server. Trimming that list, he said, limits the blast radius and the cost.
Why it matters
Our reading: treat the tool list as the real attack surface. If an agent can reach a tool, assume any user who can chat with it can ask for that tool in plain words. A policy document will not change that.
For buyers, the question to ask a vendor is where limits are enforced. Sam argued that checking inside each agent gets hard to manage at hundreds or thousands of agents. Each new agent adds more tools and more paths to check. Cutting the tool list is a cheap first step.
The other side
Sam's company sells the gateway, and he gave the talk at a conference with a booth nearby. Weigh his case with that in mind.
The demo was one hotel scenario with mocked data. In the first example, the user was allowed to use the delete tool. That points to a permissions design problem as much as an agent problem. A gateway helps only if the permissions behind it are scoped well.
Sam also admitted that chains of agents calling agents get messy and hard to follow. How well one gateway handles that at scale was not shown.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- AI Engineer: AI Agents Don't Read Your Policy Docs. They Hit Your APIs — Gravitee (2026-10-10)
