Part 5 · Reference
Agents and tool grants
Five agents, fourteen tools, and exactly which agent holds which.
01What it is
Every agent with its exhaustive tool list, and what each one is deliberately unable to do.
02Why it exists
The system prompt is not the security boundary. Telling a content agent not to read the CRM is a request; not giving it a tool that reads the CRM is a fact.
Printing the grants is what makes the claim checkable by somebody who does not read the codebase.
03How to use it
- 01Find the agent and read its list. It is exhaustive.
- 02A tool nobody is granted is dead code, and the registry test notices.
04What good looks like
- You give it
- Asking whether the content agent can see a contact record.
- You get
- Its five grants are listed and none of them reads a person.
- Why
- A content agent that can reach a person’s record will eventually write a post about a named prospect.
Derived from the rules in the code
05What weak looks like, and what it costs
- You give it
- Adding a read to an agent because one feature needs it.
- You get
- The boundary is gone and no test fails unless the grant list is the thing under test.
- Why
- This is exactly the erosion the registry exists to make visible.
Derived from the rules in the code