How do you apply least privilege to an agent's tools?

Only the tools it needs, each doing only what's needed; narrow tools over open-ended ones like a shell; read-only where possible; actions run as the user; authorisation enforced downstream on every request.

A tool that can't express a harmful action can't be talked into it.