> from the company perspective how do they, for example, have a tool call that gives the customer a discount, without it getting used when it shouldn’t?

I might be misunderstanding your point but I think you're in agreement with the gp, as in they are arguing for a locked down interface behind which the AI sits, narrowed to use within whatever particular operations the user can access, as opposed to a wide open AI interface with access to any operation (in principle).

So in your example there's no way to ask the AI for any old discount because the interface for doing so is locked down to just the discounts you can access, although the AI may be able to apply a discount you didn't ask for dynamically, if allowed, to give the customer a better experience.

Of course both versions can be implemented securely, it's just probably in general a smaller attack surface if you provide a tighter interface first.