Este análisis se ofrece actualmente en inglés. Se conserva el texto original para mantener precisión en recomendaciones y detalles técnicos.
Las fechas, datos técnicos y afirmaciones del artículo se muestran en su idioma original.
AI security · Luba Mikhalkina · 2026-09-28
Declarations are not invocations
A model may receive a tool definition without ever calling it. The Skills & Tools view separates declarations from invocations so review teams can prioritize real usage instead of theoretical exposure.
This is the difference between a capability inventory and an activity log. The first tells you what an agent could use. The second tells you what the supported integration actually observed. Both matter, but they answer different security questions.
Capability versus activity
Declared skill → Available capability → Agent invocation → Observed decision → Review evidence
Observe first, then enforce
Turn on Capture tool use in AI Firewall -> Agent Config -> Tool governance. Start with Observe only, review sources and unreviewed tools, then switch to Block calls outside the allow-list when the policy is ready.
Use narrow custom skills
Custom skills should describe one meaningful operation with a predictable payload. AI-FW validates curated payload schemas, audits the decision, and relays the instruction to the target agent instead of executing arbitrary skill code in the gateway.
Keep the evidence useful
Tool arguments are represented by metadata and digests. This supports review and correlation without turning the governance layer into an unrestricted second content store.
The operational test is simple: can a reviewer understand what happened, who initiated it, what decision was made, and where to investigate next without creating another uncontrolled copy of the payload? Digest-first records help answer that question, but they still need retention and access policies.