“The agent has access to the deployment tool” sounds like a feature description. It is also a permissions statement. The important details are which environments, which operations, and whose authority the tool uses.
I would design that boundary before trying to improve the prompt. A model can misunderstand a request or encounter hostile content. The execution layer still has to enforce the real limits.
Prefer operations with a small vocabulary
An illustrative read-only tool might retrieve deployment status for one service. A much broader tool might execute arbitrary shell commands with a production identity. Both can be described in a few sentences, but they create very different consequences.
Use explicit operations with validated parameters, bounded resource scope, and predictable outputs. The tool implementation should reject an unauthorized environment even if the model asks confidently. A prompt telling the model to be careful is not an authorization system.
Separate proposing from executing
For a restart workflow, the assistant can gather evidence and propose the exact service, environment, reason, and expected effect. The approval should bind to that concrete action. If the target or parameters change, the old approval should not silently authorize the new action.
Keep credentials out of model-visible text when the tool can use them internally. Scope the execution identity to the task and its lifetime. Avoid sharing one powerful account among unrelated assistants just because the integration is convenient.
Expect retries and partial completion
If a tool times out after starting an operation, the assistant must check the operation state before retrying. Otherwise, “try again” can duplicate a deployment or repeat a disruptive action. An operation identifier and an idempotency strategy are often more useful than a longer system prompt.
OWASP’s prompt-injection guidance supports layered controls and limited privileges. Those controls matter most when untrusted text can influence a system that has real capabilities. They reduce risk; they do not make prompt injection a solved problem.
Make review possible afterward
Record the requesting identity, proposed action, authorization decision, actual tool call, result, and follow-up verification. Redact secrets from those records. Include a stop mechanism that does not depend on the same model deciding to cooperate.
The goal is a useful assistant whose authority remains understandable. If a reviewer cannot explain what the agent can change, the interface is still too broad.