Free tools Windows power users keep installed
One-click scans. No signup required.
Check authorization in trusted application or policy code for every protected request—before the agent’s tool can reach the destination. Verify the current caller’s permission for the exact operation and target, constrain agent-supplied URLs to an explicit allowlist, and require separately validated approval for sensitive actions. An agent deciding that a request is appropriate is not an authorization check.
What authorization must establish
Authentication answers who or what is making a request. Authorization answers whether that identity may perform this particular action on this particular resource. A logged-in user, an authenticated agent, or a valid API token does not by itself prove permission to fetch a URL or access its contents. OWASP recommends checking access for each request and target in its Authorization Cheat Sheet.
As an Amazon Associate I earn from qualifying purchases.
The enforcement point should be trusted code outside the model’s own reasoning: for example, the application’s tool-execution layer or a policy component that can deny a call before it runs. The model can propose a request; it should not be the component that grants itself permission. OWASP’s AI Agent Security Cheat Sheet describes independent execution checks, least privilege, approval controls, and auditability.
Recommended Free Tools
Use this authorization sequence for each request
- Establish the caller. Identify the authenticated user or principal the agent is acting for. Preserve that context through the tool call rather than substituting a broad shared account.
- Normalize the request. Resolve the tool or connector, HTTP method, destination or resource identifier, and relevant parameters into a canonical form. Evaluate the request that will actually execute, not a loosely related description supplied by the model.
- Constrain the destination. Parse an agent-supplied URL and compare it with an explicit destination allowlist before making a network request. Reject destinations outside the permitted scope, including internal services and cloud metadata endpoints, unless the application has deliberately authorized them. Do not treat prompt instructions or a plausible-looking hostname as a security boundary.
- Check current permission for the exact operation and target. Ask whether this caller may perform this action on this resource now. Do the check on every protected call; permissions can differ by user, resource, operation, or time.
- Use narrow credentials. Give the specific tool or connector only the access its task needs. Keep read access separate from write or administrative access, and avoid credentials that grant unrelated access.
- Require approval for high-impact actions. For sensitive, destructive, financial, externally visible, or security-relevant actions, require explicit approval and validate it independently at execution time. Bind it to the actor, tool, target, normalized parameters, time, and expiry so it cannot be reused for a different request.
- Fail closed and record the outcome. If a required permission lookup, approval check, or audit step fails, do not execute a high-impact action. Record the decision and execution result without logging secrets.
Why URL checks matter for AI tools
A URL proposed by an LLM is untrusted input. Prompt injection or other hostile content can steer a URL-fetching tool toward a destination the user did not intend. If the application fetches it from its own network, an attacker may try to use the tool for server-side request forgery (SSRF), including attempts to reach internal services. OWASP’s MCP Security Cheat Sheet warns against arbitrary URL fetching without strict allowlist validation.
#1 Best Overall
Apply the destination check before the request leaves the trusted execution layer. A hostname appearing benign in a prompt is not sufficient validation, and authorization to use a browsing tool does not automatically authorize every destination that tool can reach. Treat the permitted destination scope as a separate part of policy, alongside the caller’s permission to perform the requested operation.
Scope tools, connectors, and approvals to the task
Permissions should follow the tool’s purpose rather than the agent’s general capability. A connector that only needs to retrieve records should not receive write access; an agent working for one user should not inherit a service account’s access to everyone’s data. OWASP Cornucopia’s AAI6 guidance recommends query-time checks against the user’s permissions, minimum connector access, logging, and data-isolation testing. Its AAI9 guidance addresses minimum tool access, approval for security-relevant changes, and gating based on reversibility.
Approval is not a substitute for authorization. A human confirmation should authorize only the specific normalized action presented for approval; the execution layer should still validate that approval and the caller’s permission when the request runs. Expired, mismatched, or altered approvals should be rejected.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Make decisions reviewable and test the denial paths
Keep structured records sufficient to reconstruct why a request was allowed or denied: the authenticated actor, tool, normalized target and operation, policy version, decision, approval identifier when applicable, and execution result. Do not put secrets in the log. OWASP’s AI Agent Security Cheat Sheet includes audit metadata and security testing among its recommendations.
Test both permitted behavior and attempts to bypass the controls. Useful cases include cross-user data access, a URL outside the allowlist, a prompt-injection-driven change of destination, a stale approval, and an approval whose actor, target, or parameters do not match the request. Also verify that permission lookup or approval validation failure prevents execution. OWASP recommends testing isolation and authorization behavior; these examples apply those controls to agent web requests.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compare designs by their enforcement points
When reviewing an implementation, focus on where permission is decided and whether that layer can stop the request. Compare how actor identity reaches it, how destinations and resource-operation scope are constrained, whether credentials are isolated and narrow, which actions require approval, and whether decisions can be audited and tested. OWASP’s Agent Control Standard (ACS), published September 1, 2026, describes runtime policy enforcement and agent inspectability, traceability, and control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
