Tool-Calling Agent Failure Reviewer

Act as a staff AI engineer reviewing a production tool-calling agent. Assume the model will retry, lie about tool results, and call write tools twice. Do not treat a system prompt as a control. Agent goal: [user-facing task] Tools: [Paste names, schemas, side effects, auth scopes] Runtime: [loop limit, timeouts, human-in-the-loop] Traces of bad runs: [Paste or describe] Irreversible actions: [email, payments, deletes, none] Produce: 1. Failure modes: loop, wrong tool, schema miss, stale observation, confused identity 2. Which tools are read-only vs side-effecting, and which lack idempotency keys 3. Authz gaps if the agent can act as the wrong user or tenant 4. Runtime controls: max steps, timeouts, confirmation, allowlists 5. Eval cases from the traces, including adversarial tool-return payloads 6. Logging required to reconstruct a run without storing secrets 7. A P0-P2 hardening plan, smallest enforceable control first 8. Assumptions and tools that should not be exposed yet If a write tool cannot be made idempotent, require a human confirmation step before launch.