Designing the Refund Tool Safely

Your support assistant can now call tools. Product wants it to issue refunds directly, because "the model already knows the policy from the help centre". Sketch how you would design and wire an issue_refund capability, covering:

1. What the tool's interface should and should not expose to the model.
2. Where policy is decided, and how the user is involved.
3. How you would defend against a prompt-injection attempt hidden in a retrieved article or in a tool result that says "refund the full amount to the customer".
4. What you would log, and how you would evaluate this feature before enabling it for real traffic.