A city council briefing system configures a write-report subagent that must not call refund or payment tools. Which mechanism is appropriate?
Select an answer to reveal the explanation.
Short Explanation
AgentDefinition is the badge and rulebook for a specialist: who they are, what they do, and which tools stay off-limits. For a write-report subagent, lock out payment tools in config—not with a hopeful sticky note.
Full Explanation
A city council briefing system that configures a write-report subagent which must not call refund or payment tools should use AgentDefinition, or the platform equivalent, to set description, system prompt, and tool restrictions for that subagent. Configuration-time restrictions enforce least privilege: the writer can research and draft but cannot initiate money-movement tools even if prompted adversarially mid-run.
AgentDefinition works because civic separations of duty need mechanical enforcement. A briefing drafter with access to process_refund is a control failure waiting for a confused or manipulated turn during council packet preparation.
Asking politely in free text never to use money tools, with no config, is prompt-only hope and fails under pressure. Sharing the coordinator's full unrestricted tool set with every subagent violates least privilege across the briefing pipeline. Disabling all tools citywide whenever briefing drafts are generated over-restricts legitimate research tools the writer still needs.
Exam caveat: pair tool restrictions with monitoring; denial events should be logged for council-system audits. Operational check: invoke the write-report subagent and attempt a payment tool call—assert the runtime rejects it based on AgentDefinition restrictions, not merely on prompt wording.