A court system wants its coding agent to query case-record data through a court-records integration, but only with a narrow set of read operations rather than the integration's full API surface. What configuration achieves this?
Select an answer to reveal the explanation.
Short Explanation
Think of it like handing someone a library card that only opens the reference section instead of a master key to the whole building. A scoped plugin does exactly that: it exposes just the narrow read operations the agent actually needs, backed by credentials that can't reach anything beyond that. Telling the agent to "only read" while handing it the master key just means the door was never locked in the first place.
Full Explanation
Agent tool integration on Google Cloud can be scoped at the plugin or extension level, so the credentials and available operations exposed to the agent match exactly what the task requires, rather than the full surface of the underlying system. For a court-records integration, that means configuring an integration that only exposes the specific read operations casework needs.
Granting full API credentials and relying on system-instruction text to constrain behavior is a prompt-level control, not an access control — instructions can be misread or worked around, while the credential itself still permits everything. Pointing a general-purpose MCP server at the entire API with no operation-level restriction leaves the same broad surface reachable, regardless of intent. Wrapping the same broad credentials in a dedicated subagent narrows who calls the API but not what that caller is able to do with it.
Scope note: operation-level scoping should be re-verified whenever the underlying court-records API adds new endpoints, since a broad credential set can silently regain capability. Operational check: attempt a write or bulk-export call against the integration in a test environment and confirm it's rejected.