Why tool scoping matters more than anything the model is told Part 7 findings of an experiment: building an LLM-powered support agent with deterministic boundaries. The companion repo contains the full code. Somewhere in this system is a prompt that says "only ever access the requesting customer's data." Here's the uncomfortable question: what enforces that? If the answer is the prompt itself — or the model's good intentions on the day — you don't have a permission system...