An airline's Model Context Protocol server offers tools to read a booking, read a fare rule, and cancel a flight. The passenger-facing agent may explain a booking and must not cancel a flight. Which tool exposure should the architect approve?
Select an answer to reveal the explanation.
Short Explanation
You can let the passenger-facing agent look up a booking and fare rule without giving it a way to cancel a flight. Least privilege means exposing only those read tools and leaving cancel flight off that agent.
Full Explanation
A protocol server can offer more tools than a particular agent should have. Because the passenger-facing agent may explain a booking but must not cancel a flight, expose only the read-booking and read-fare-rule tools to it, and leave cancel flight off. Exposing every tool on the server, including cancel flight, gives the passenger-facing agent an action the design forbids. Exposing only cancel flight while withholding both read tools leaves the agent unable to provide the intended explanation and still gives it the prohibited action. Exposing cancel flight to the passenger-facing agent while reserving the read tools for an internal agent reverses the needed access: the passenger agent can cancel but cannot read. Least privilege is enforced by controlling which tools the agent receives, not by relying on an instruction telling it not to use a tool. Exam caveat: an employee agent may be permitted to cancel under its own approval, but that permission is not inherited by a passenger-facing agent that shares the server. Practical check: inspect the passenger-facing agent’s enabled tools and confirm read booking and read fare rule are enabled while cancel flight is not.