Your team deploys a conversational AI agent that uses an LLM with tool-calling to manage a production WAN. The agent has read-only tools (get interface state, get BGP neighbors) and one write tool that pushes RESTCONF configuration changes to edge routers. During testing, the LLM occasionally misinterprets ambiguous operator requests and calls the write tool with configuration that would black-hole traffic. Management accepts that read tools can run autonomously but wants to eliminate the risk of the agent making unintended production changes. Which design change best mitigates this specific risk while preserving the agent's usefulness?