A school-district helpdesk wants an orchestrator that sends password resets to IT tools and curriculum questions to a read-only knowledge agent. What routing principle should it apply?

Route by task class so tool-enabled password resets and knowledge-only curriculum questions use different agent roles. A school-district helpdesk orchestrator should send resets to IT tool agents and curriculum questions to a read-only knowledge agent because those task classes have incompatible permission needs. Password resets need wrenches; curriculum FAQs need a library card. Task-class routing applies least privilege at the orchestration layer and reduces the chance that a curriculum conversation can invoke directory-changing tools.

Routing by queue load so password resets and curriculum questions share whichever agent has capacity available fails by concept: it ignores incompatible permission needs and can send password resets to read-only agents or curriculum questions to tool-enabled agents, risking failed resets or accidental directory changes. Routing both types to the knowledge agent and attaching directory-write tools for reset coverage fails least privilege—giving a read-only knowledge agent directory-write tools exposes curriculum sessions to reset actions and concentrates write power where it is not needed. Collapsing both paths into one agent with unrestricted write tools fails by concentrating maximum privilege into every session regardless of ticket type.

Exam caveat: routing by task class requires reliable classification; ambiguous tickets need a safe default (usually read-only) and human escalation rather than guessing into write tools.

Operational check: implement intent classifiers or deterministic forms that label reset versus curriculum, bind tool belts per role, deny directory tools on knowledge sessions, log routing decisions, and audit any write-tool invocation originating from curriculum-labeled tickets.