Tool permissions are the real security boundary

Almost every published agent incident this year followed the same path: the model was persuaded to call a tool it should have been able to call, using a credential that was broader than the task required.

Hardening the prompt is worth doing and will never be sufficient. Scoping the credential to the task, and expiring it with the run, converts a class of incidents into a logged failure.