agentsop-tool-scoping

Tool Scoping · Per-Agent Tool Binding (Least-Privilege Discipline)

Overlay posture: the base frameworks ([[crewai]], LangChain, LangGraph) all define tools and bind them, but treat scoping as a one-line "assign tools to the agent that needs them" footnote. This overlay makes the rubric first-class. Non-trivial claims cite inline against references/R1-source-evidence.md.

The lever the base skills under-surface: tool definition and tool binding are two separate decisions. You define a tool once (reusable class/function), but you bind it per-agent deliberately. The [[crewai]] SKILL states this in one clause — "tool 定义可复用；但每个 agent 只绑定其角色匹配的工具" [crewai-sop §DC-3] — and then moves on. Production failures (wrong-tool selection, an agent running a destructive op outside its role) come from skipping the binding decision and defaulting to "give everyone everything."

---

1. 何时激活 (When to Activate)

Activate when any of these hold:

• The system is multi-agent (CrewAI crew, LangGraph supervisor/swarm, AutoGen group) AND at least one agent holds ≥1 tool.
• A single agent holds many tools (rule of thumb: ≥8 — see OP-4) and tool selection has started degrading (picks the wrong tool, or "tool-hops").
• You are tempted to give all agents all tools — tools=[search, exec, db] copy-pasted onto every Agent(...), or one bind_tools([...everything]) call reused for every node. This is the canonical trigger.
• A tool has side effects (DB write, payment, email, DELETE, shell exec, outbound HTTP POST) and you are deciding who may hold it.
• You are doing a security / blast-radius review of an agent system and need to answer "which agent can do what, and why."

Do not activate for: a single agent with 1–3 read-only tools (scoping is trivial), or a stateless single LLM call with no tools.

---

2. 核心心智模型 (Core Mental Model)

A tool is a capability grant, not a convenience. Binding a tool to an agent is the same act as granting a Unix process a syscall, a service an IAM role, or a container a Linux capability. The discipline is identical and ancient: least-privilege — an agent should hold only the tools its role actually needs.