A civic policy synthesizer often needs quick fact checks but must not get full open-data search rights. What tool-distribution pattern fits?

In civic agent design, tool distribution is a privilege model, not a convenience toggle. A policy synthesizer that only needs frequent fact checks should receive a narrow verify_fact tool scoped to high-frequency validation—confirming a citation, checking a published figure, or verifying a statute label—without inheriting full open-data search and write rights across municipal systems. That pattern matches least privilege: give the synthesizer the smallest capability that reliably covers the recurring need.

Why the correct option works: a dedicated verify_fact surface keeps validation in-band for the synthesizer’s workflow while withholding broad discovery and mutation tools. Architects can rate-limit, audit, and deny-list that single tool without exposing GIS layers, budget ledgers, or resident PII stores. The synthesizer still grounds claims in sources; it simply cannot roam the entire open-data estate.

Why the other three fail by concept: granting unrestricted search and write tools to every synthesizer collapses separation of duties and turns a drafting agent into a privileged operator of municipal systems. Removing all fact-checking tools forces invention of citations from model memory—unacceptable for civic policy work that residents and councils will treat as authoritative. Forcing tool_choice none blocks tool-backed validation entirely, so the agent cannot call even a scoped verifier when a claim needs grounding.

Exam caveat: do not confuse “fewer tools” with “no tools.” Narrow tools are still tools; the exam point is scoped distribution across roles, not blanket denial. Operational check: inventory each civic agent’s allowed tools against its job—if a synthesizer can search or write beyond fact verification, shrink the tool set to verify_fact (or equivalent) and retest that policy drafts still pass citation checks without broader MCP search rights.