Tools need small contracts
Give an AI feature the capabilities its job actually requires.
Describe the operation precisely
A tool is an operation an agent can request with structured inputs. A lesson-search tool might accept a query and return lesson IDs with excerpts. A progress-read tool should use the authenticated learner context, not accept arbitrary ownership claims.
Separate explanation from action
A coach that explains a lesson need not send email, edit account settings or access real clinical systems. Smaller capabilities reduce complexity and make behavior easier to verify. Treat retrieved text as data; it cannot authorize extra actions.
Enforce permission outside the model
A valid tool-call shape does not prove the action is authorized. Check the authenticated caller, exact resource and allowed action in application code before execution. Retrieved documents and tool results may contain misleading instructions, so they must not grant new permissions. Separating instruction text from source text helps communicate the boundary but is not a complete security guarantee.