An operations lead is automating competitive brief creation that needs current pricing from the web, internal docs from SharePoint, and issue creation in GitHub, with least-privilege access. Which tool strategy should the lead apply to select and configure tools within automations?

The correct strategy succeeds because it matches functional completeness with security restraint by enabling only web search for current pricing, document retrieval for SharePoint knowledge, and issue creation for GitHub, each using narrowly scoped least-privilege credentials that limit blast radius while preserving capability. The internal-only retrieval and issue-creation approach is a sound pattern for secure knowledge work and satisfies least privilege, but it fails functional completeness by omitting web search and therefore cannot provide current external pricing. The all-capabilities approach under one shared credential is a common simplification to ease rotation and management, but it fails privilege separation because a single credential grants more access than any individual action needs and increases compromise impact. The web search plus retrieval plus read-only GitHub lookup approach reflects prudent change control to avoid unintended writes, but it fails action completeness because lookup without write permission cannot create the required issues. An exam caveat is that generally recommended hardening or efficiency patterns remain wrong when they violate an explicit stem constraint, so prioritize stated needs for sources, actions, and least privilege over generic best practice. A practical check is to map each automation step to its minimum tool and scope, then validate with test credentials that fresh pricing is returned, the correct SharePoint file is retrieved, issue creation succeeds, and unrelated sites or repositories stay inaccessible.