Least privilege is old advice. Scope every component to the access its own work demands and withhold the rest, so that a compromise anywhere stays confined to what that one component could already reach. The principle has governed the design of operating systems, service accounts, and API credentials for decades, and every senior engineer already believes it. With autonomous systems the principle…

The interface between an agent and the outside world is not a flat list of functions. When you look closely at what an agent can actually reach, the capabilities sort into a small number of kinds, and the line that separates them is not what each one does. It is who decides to use it. Some capabilities the model invokes…

The hard part of connecting a model to the world was never the model. It was the connection. Every agent that does anything useful reaches outside itself into a database, an internal service, a search index, a ticketing system, and each of those reaches is an integration that someone has to write, secure, and keep working. As long as each of those integrations is…

Most agents end up holding more tools than they use. Each one seemed reasonable to add at the time, and none of them seemed expensive to keep. The place this reasoning breaks is in what a tool actually is to the model. A tool is not an action the agent reaches for only when the moment calls for it. It…

A retry is the most ordinary thing an autonomous system does with a failure, and the one a tool is least often built to survive. When a call comes back failed, the model may simply issue it again, on its own judgment, with less context than the engineer who wrote the tool and no way to know whether a second…

When a tool succeeds, its return value is data. When a tool fails, its return value is an instruction. An autonomous system reads the failure and immediately decides what to do about it: try the same call again, change the arguments and retry, hand the problem back to a person, or abandon the path and take another. That decision is made by the model, in…

Once a model has chosen a tool, one artifact decides whether the resulting call is any good: the input schema. It is read at two different moments by two different readers. The model reads it while it writes the arguments, and your system reads it when it decides whether to accept them. Most teams design a schema entirely for the second…

When an agent reaches for the wrong tool, the instinct is to inspect the code: a broken function, a malformed schema, a name that should have been clearer. Almost none of that touched the decision. By the time any tool executes, the model has already settled on it, and it settled by reading natural language. The thing that actually drove the choice is the…