What You Need to Know
A tool is a capability wired into (included in) an agent's configuration. Least privilege gives an agent only the tools its role needs. Capability bloat is every tool beyond what the role needs. A mitigation limits harm but leaves the tool wired. Where removal is available, choose it over mitigation every time.
This lesson uses one made-up example throughout: a telecoms provider that sells mobile and internet plans. Its support agent reads customer tickets and drafts replies. It finds customer accounts through three near-identical lookup tools. The agent also has refund and delete-account tools, which that role never needs.
Every Unnecessary Tool Costs Twice
A tool that the role never needs is pure risk with zero benefit. It has two costs.
Security. If a tool is wired, the capability exists, whatever the system prompt says. Model error, user manipulation or prompt injection (instructions hidden in content that the agent reads) can reach it. Attack surface is everything an attacker could reach. It is what the configuration permits, not what the instructions request. A "never issue refunds" prompt leaves the provider's refund tool reachable.
Performance. Every tool definition uses context on every request. Overlapping or vaguely described tools confuse the model when it chooses between them. A bloated toolset is slower and less accurate as well as less safe. The provider's agent has two unused definitions in context on every message. Anthropic's tool-writing guidance says more tools do not always lead to better outcomes. Anthropic's tool-search documentation says tool selection degrades once the number of available tools exceeds a documented threshold.
A minimal configuration is better for both security and performance. A role that needs many capabilities gets progressive discovery (loading tools only when a task needs them, objective 3.8), not a monolithic catalogue (one large catalogue loaded on every request).
Start From the Role's Task List
Judge a configuration as you judge database grants: from the role's task list, never from the platform's capability list. Remove anything that the workflow does not need. An agent that only reads and drafts, like the provider's support agent, justifies exactly those two capabilities. This is true however useful a refund tool might be to somebody else. Anthropic's guidance applies the same rule to tool design: build a few thoughtful tools for specific high-impact workflows rather than wrapping every available endpoint.
Removal Beats Mitigation
Mitigations are real controls, but they address the wrong problem. If you name the category of each control, you can exclude it quickly:
| Offered control | Category | What it cannot do |
|---|---|---|
| Audit logging | Detective | Finds abuse after the damage; the capability stays wired |
| Confirmation prompt | Compensating | Adds friction to a capability that should not exist |
| System-prompt prohibition | Instruction | Constrains behaviour, not capability; one manipulation from failing |
| Removing the tool | Elimination | Nothing; the risk no longer exists to detect, guard, or prohibit |
For the provider, a log records a bad refund after the money has gone. A confirmation prompt leaves refunds possible. Removing the refund tool makes refunds impossible.
Consolidate What Survives
Least privilege is not only removing tools. Overlapping or vaguely described tools confuse the model's choice and waste context, even when each tool is justified. Consolidate related operations into fewer clearly described, task-scoped tools. Namespace them (give related tools a common prefix) so the model can distinguish them. A few well-named tools work better than many granular near-duplicates. The provider's three near-identical account lookups would become one.
In the exam
The guide's own Domain 3 sample is a small version of this objective. A support agent that only reads tickets and drafts replies is also wired with refund and delete tools. The right answer removes them. Most questions on this objective have the same shape: a configuration, four candidate changes, one that reduces risk. The two benefits of a minimal configuration are why the exam makes it the right answer so consistently.
The Right Answer Removes
The guide's sample includes these wrong options: logging (detective), a confirmation prompt (compensating) and a larger model. A larger model is irrelevant, because model capability has nothing to do with authorisation scope. When the question says that the role never needs the capability, the option that eliminates that privilege is correct every time.
Current tool-search threshold figures are figures from a stated date. The Domain 3 quick reference holds them.
Exam Traps
Adding audit logging or a confirmation prompt to a tool the role never needs
Logging is a detective control that finds abuse after the damage, and a confirmation prompt is a compensating one. Neither removes the capability, which stays wired and reachable. Remove the tool the role never needs.
Relying on a system-prompt prohibition to prevent a wired capability being used
An instruction is not an access control. If the tool is in the configuration the capability exists, reachable through error, manipulation, or prompt injection. Only removing or scoping the tool changes what is possible.
Choosing a larger, more instruction-following model to fix an over-privileged configuration
Model capability has nothing to do with authorisation scope, so the refund tool stays wired under any model. Remove or scope the tools the role does not need.
Wiring the platform's full capability catalogue so the agent 'can handle anything'
Every tool definition takes up context on every request. Tool selection degrades once a documented threshold of tools is exceeded. Each extra wired tool adds attack surface. Wire only the tools a named task needs, with progressive discovery for a large set of tools.
Practice Scenario
An internal HR agent can read employee records, update them, generate letters, and export payroll data to CSV. It exists solely to answer questions from employees about their own leave balances. Which change best reduces risk?
Build Exercise
Tool-Set Audit With Least-Privilege Justification
What you'll learn
- How to inventory an agent’s full set of tools against the role task list
- How to name the control category of every mitigation and the gap it leaves
- When to remove, scope, or consolidate a tool
- How to write a per-tool justification that passes review
- Take an agent you operate — or design one — and list every tool in its configuration, one line per tool
Why: The audit starts from what is wired, not what is intended. Most tool sets are larger than their owners remember.
You should see: A complete tool inventory, including the tools nobody has thought about since setup.
- Write the role task list, then classify each tool: required for a named task, or not
Why: Least privilege starts from the task list and finds the tools each task needs. It never starts from the capability list.
You should see: Every tool tagged with the task that justifies it, or flagged as unjustified.
- For every mitigation currently guarding a tool — log, confirmation, prompt rule — name its control category and what it cannot prevent
Why: Detective, compensating, and instruction controls each leave the capability wired. Naming the category is the exam skill for eliminating wrong options.
You should see: A category label per mitigation and one sentence on the gap it leaves.
- Remove or scope every tool not justified by a task, and consolidate overlapping tools into fewer, clearly-described ones
Why: Removal eliminates risk that mitigation only manages, and consolidation improves selection accuracy while reducing the number of tools.
You should see: A smaller toolset in which every remaining tool has one clear purpose and no near-duplicate.
- Write one sentence per surviving tool justifying it against a named task; if you cannot write the sentence, remove the tool
Why: The justification sentence is the audit artefact — and the exact reasoning the exam asks you to perform on configurations you did not build.
You should see: A one-line justification per tool, each naming a task from step two.
Sources
- Writing effective tools for agents — Anthropic
- Tool search tool — Anthropic
- Claude Certified Architect Professional Exam Guide (v1.0) — Domain 3 — Anthropic