Tool Scoping and Least Privilege: Making the Dangerous Thing Impossible
Containment, part one — the permission surface. Because the model can be talked into anything, the runtime has to make the dangerous action impossible: read-only defaults, parameter constraints enforced in code, scoped short-lived credentials, egress allowlists in infrastructure, and gates that bind to exact parameters.
Content current as of 2026-09.