You are building an agentic assistant for an internal operations team. The model can chat with users and also call tools that read records, create tickets, and send messages. You need a clear boundary between what the assistant is allowed to say and what it is allowed to do.
How would you design a content filter for what an agent is allowed to do, separate from what the model is allowed to say?