How are you securing tool execution in LLM workflow/agent systems?

I've been working on an open-source workflow automation platform that supports LLM-powered workflows, browser automation, HTTP requests, file operations, email, MCP servers, etc.

One challenge I've spent a lot of time thinking about is tool execution security.

Some of the things we've implemented are:

• Sandboxed tool execution
• Input validation before tool execution
• Permission checks for workflows and resources
• Structured execution logging and trace IDs
• Memory isolation between agents
• Human-in-the-loop approval for sensitive actions
• Retry boundaries and execution guards

Even with those in place, I still feel there are attack surfaces that are easy to miss, especially around:

• Prompt injection through retrieved documents
• Tool abuse via indirect prompt injection
• Multi-agent trust boundaries
• MCP server permissions
• Data exfiltration through seemingly harmless tools

For those building agentic systems or LLM applications, what additional safeguards have you found valuable?

Are there any papers, open-source projects, or design patterns you think are worth studying for securing agent workflows beyond the usual input validation and sandboxing?

I'd really like to hear how others are approaching this problem, since it feels like one of the harder parts of building production-ready LLM systems.