Replace one broad tool with a narrow one

The prompt

Pick the single broadest tool or permission an agent has access to in this project (a shell, an admin role, an unscoped API key). Design a narrow, typed replacement: a clear purpose, constrained arguments, predictable output, a timeout, and an auditable authorization path.

Why it's built that way

A good tool has a clear purpose, constrained arguments, predictable output, timeout behavior, and auditable authorization. The handbook's implementation note is blunt: convenience permissions granted during a pilot tend to survive into production and defeat the entire control model.

What to do with the answer

Ship the narrow tool, then actually remove the broad one — a narrow tool that coexists with the old broad access doesn't change anything.