A school-district agent retrieves grading policy in one path and must not expose student PII tools on that path. Which pattern best enforces least-privilege isolation?

Subagents so grading-policy retrieval cannot access student PII tools best enforce least-privilege isolation for a school-district agent that retrieves grading policy on one path without exposing student PII tools on that path. Separate subagents are separate desks: the policy desk gets handbook/retrieval tools only; the student-records desk—if needed elsewhere—gets PII tools under stricter controls. The policy path physically cannot invoke student PII capabilities if those tools are not on its belt.

Relying on prompt instructions to separate policy work from PII tools fails least privilege because natural language is not a runtime boundary; the policy path can still reach student PII tools unless they are physically removed from that agent's tool registry. Attaching the full toolset to one agent with output filters to redact student PII fails least privilege because redaction happens after the tool call, so the policy path still invokes PII capabilities and the blast radius remains maximal. Caching student PII in shared memory for reuse across policy and grading tasks fails least privilege because shared memory lets the policy path read or leak records it was never meant to touch, collapsing isolation between the grading path and student records.

Exam caveat: isolation must be enforced in the runtime tool registry, not merely instructed in natural language. Watch for orchestration bugs that attach the wrong tool belt after classification errors; default ambiguous asks to the policy-only agent.

Operational check: register disjoint tool sets for policy versus student-record subagents, attempt PII tool calls from the policy path in tests (must deny), redact logs, train routing to prefer policy-only for handbook questions, and audit any cross-belt access attempts.