Your multi-agent pipeline has five worker agents that each require access to different external APIs (database, search, calendar, email, file storage). The team is debating whether each agent should have its own tool set or whether all agents should have access to all tools. What is the architecturally correct approach and why?

D is correct because least-privilege tool assignment is the fundamental security principle for agent systems. Restricting each agent to only its required tools limits the blast radius of any agent failure, misinterpretation, or prompt injection — a compromised search agent cannot access the email API if it was never given email tools. This also makes agent behavior more predictable and auditable. A is wrong because safety training reduces but does not eliminate misuse risk, and giving all agents all tools creates unnecessary attack surface. The 'self-recovery' argument is a rationalization that trades security for marginally improved fault tolerance. C is wrong because a shared tool broker with audit logging addresses auditability but not least-privilege — an agent with access to all tools through a broker can still misuse any of them. B is wrong because granting progressively broader access to later pipeline stages is an anti-pattern — it creates a high-privilege execution context for agents operating on already-processed (and potentially attacker-influenced) data, which is exactly backwards from least-privilege principles.