Define an operation before exposing a tool
Describe what the operation may change, the inputs it accepts, the identity it uses and the result it returns. A tool should represent a bounded business operation rather than a general-purpose execution surface.
Authorisation belongs in the service
The backend must validate the caller and the requested operation. A statement in the conversation that someone is a manager or administrator is not an entitlement. Approval requirements also need to be enforced outside the model prompt.
Design for the second attempt
Retries and repeated events are normal in enterprise systems. Decide how duplicate requests are detected, which operations are idempotent and how a caller learns that work has already been completed. Handle partial success explicitly.
Make the outcome supportable
Record the business reference, correlation and outcome needed to investigate a failure. Test the denied action, the timeout and the unavailable dependency, as well as the successful path. These are release concerns, not post-launch refinements.