Giving tools to an AI agent: why I set the limit outside the prompt

When I give tools to an agent, I treat it like a third-party dependency: I don't trust it, I contain it.

The rule that matters: the constraint is set when the process starts, not in the prompt. A prompt is a request. The model can ignore it, or be turned around by malicious text slipped into what it reads.

On an agent I built, the tool list is closed in advance: twelve read tools allowed, fifteen write tools refused. It can't write a file or send a message, even if it tries.

Why this instead of "a good prompt": an agent that can act does what its environment allows, not what it was politely asked. If the action is impossible, there's nothing left to trust.

I care less about the speed these tools bring than about how to contain them: that's what lets you move fast without pulling code into a repo that nobody has read.

Amine Affif, full-stack developer in Paris. amineaffif.com