Tool chain composition analysis

Control objective

Tool chain composition analysis checks the sequence of tools an agent strings together in a single task, because individual steps that are each harmless can combine into a dangerous workflow - for example read a customer record, then look up their account, then initiate an external transfer. Reviewing the chain rather than isolated calls catches emergent risk and forbidden combinations that single-tool checks miss. The control requires that 100% of tool-chains longer than 5 steps that affect external systems are analysed, and that 0 forbidden compositions are executed. To implement it, capture the planned or actual ordered graph of tool invocations for each agent run, and evaluate it against a policy that defines forbidden adjacencies and patterns (e.g. read-PII followed by external-send, or any chain combining data egress with privilege escalation); analyse chains over five steps that touch external systems before or at execution time and block any that match a prohibited composition. Log the full chain, the steps flagged, the policy rules triggered, and the decision as evidence. The threshold is absolute - any unanalysed qualifying chain, or any forbidden composition that actually runs, is a breach that should halt the workflow and trigger review of both the run and the composition policy. Aligns with IBM Tool Chaining and MAESTRO L3.