TechOneDigital Start a pilot

Custom Agents

AI Tool Connectors

Your systems exposed to agents through tools with fixed, whitelisted operations.

Available now · Human approval · Complete audit trail

The operational problem

API access is usually broader than an agent’s job

Giving an agent a generic API client or administrator credential moves safety into prompt wording. The model may be told not to delete a record while the credential can still do it.

A tool connector exposes a short contract of named operations. Inputs are validated, credentials carry the minimum scope, disallowed operations do not exist and refusals remain visible in the log.

Connector contract

What a safe agent tool defines

Operation allowlist

Only the reads and writes required by the approved process are implemented.

Typed inputs and outputs

Identifiers, required fields, formats and returned evidence have explicit schemas.

Minimum credentials

The connector uses the narrowest supported account, role or token scope.

Approval context

Mutating operations carry the exact proposed action and approval identity when required.

Refusal and audit

Invalid, unapproved and unavailable operations fail predictably and are logged.

Build method

How an API becomes a bounded agent tool

  1. Start from the process needRequired operations come from the approved workflow, not from everything the source API offers.
  2. Read the supported APIAuthentication, permissions, rate limits, errors and stable identifiers are mapped.
  3. Design the operation contractEach tool receives a narrow purpose, typed schema and explicit error behaviour.
  4. Implement least privilegeThe connector and source credential are restricted independently where the platform allows it.
  5. Test allowed and denied pathsSuccess, invalid input, missing approval, unavailable source and forbidden operations are exercised.
  6. Document reuse and ownershipThe operation list, credentials, tests and maintenance responsibilities ship with the connector.

Example connector

Allowed and refused operations are explicit

Illustrative connector contract — no customer system details

System
Your ticketing tool
Read
ticket, comments, status, SLA
Write
add comment (approved)
Refused
close, delete, reassign
Tests
18 passed

Security judgement

The rules behind least-capability tools

If the operation does not exist, the model cannot call it

Removing capability is a stronger control than instructing an agent not to use it.

Read and write are separate tools

They can carry different credentials, approval rules and audit requirements.

Identifiers are validated

The connector resolves and checks the target rather than trusting a plausible free-text reference.

Refusal is part of the interface

A denied action returns a stable, inspectable result that the agent and operator can handle.

Fixed start

What the one-week connector build delivers

  • Operation contractA short documented list of allowed reads and writes with typed schemas.
  • Working connectorOne selected system exposed through the agreed controlled operations.
  • Permission configurationSource credential, role and approval requirements recorded without exposing secrets.
  • Positive and negative testsAllowed operations succeed; invalid, absent and forbidden operations refuse visibly.
  • Maintenance notesDeployment, configuration, API dependency and ownership documented for reuse.

Fit

When a tool connector is—and is not—ready

A good fit

  • An approved process needs a small, stable subset of operations from one system.
  • The source has a supported API or command interface with controllable credentials.
  • The connector should be reusable across more than one agent workflow.

Not the right fit

  • The only proposed access is an unrestricted administrator session.
  • Required operations cannot be named or separated from the rest of the system.
  • The source interface is unsupported, unstable or legally unavailable for automation.

Where the human approves

You approve the allowed list. The AI works through a fixed list of allowed operations; every approval and result is logged.

Architecture questions

Questions a system owner should ask

Is a connector the same as giving the agent API access?

No. The connector presents a narrow operation contract and can hide most of the source API entirely.

How are credentials stored?

The deployment uses the agreed secret-management mechanism and minimum source scope. Secrets are not placed in prompts, logs or source code.

Can a read-only connector later add writes?

Yes, but each new write is a deliberate contract change with its own permission, approval, test and audit requirements.

What happens if the agent requests an unsupported action?

The operation is unavailable or explicitly refused. The refusal is returned in a stable form and recorded for review.

Do you use MCP?

MCP can be one delivery interface for the tool contract. The security model remains the same: narrow operations, typed inputs, controlled credentials, tests and refusals.

Experience behind the service

Built from operational connectors we use ourselves

TechOne uses bounded connectors in its own document, research and operations work, including tools for deployment, services, backups and TLS. The reusable pattern is the operation contract and refusal model, not unrestricted system access.

Technical stewardship: David Máj, Founder & Technology Consultant. Last reviewed 24 September 2026.