An LLM agent in your product can call your internal tools: read customer records, issue refunds, send emails. What does the backend owe here?
Answer it out loud before you open anything. The value of the flags below is in comparing them to what you actually said.
The situation behind the question
A support-assistant feature. Tools are exposed to the model as function definitions and dispatched by a service that holds an internal API key.
What it is really testing
Whether the candidate treats a tool call as an untrusted client request. The prompt is input; the model is a caller; nothing about a tool definition constrains what actually gets invoked.