Agent architecture Tool permissions are an authorisation problem, not a prompt problem "You must never issue a refund over £500" in a system prompt is not a control. It is a request. The boundary belongs in the tool layer, where it can be enforced.