The instinct when building an agent is to hand it everything: the database, the email client, the payment API. It feels powerful. It is also how you end up explaining a refund loop to a finance director.
We scope agents the way we scope service accounts. Each tool has an explicit permission, a rate limit and a maximum blast radius. Anything irreversible — money moving, data deleted, a message sent to a customer — passes through a confirmation step or a queue a human drains.
Then we log every call. Not the summary, the actual arguments and results, retained long enough to reconstruct any decision after the fact. When something odd happens, the question "what did it do" should take thirty seconds to answer.
Counter-intuitively, the tighter the scope, the better the agent performs. Fewer tools means fewer wrong turns, shorter context and cheaper runs. Capability you remove is usually accuracy you gain.