Courts IT must keep a public FAQ agent from using the same mutable docket tools available to an internal staff agent. Which governance approach fits?

Role-separated tool access so the public FAQ agent cannot use internal docket mutation tools is the governance approach Courts IT needs. Public and staff audiences have different privileges: residents should receive read-oriented guidance, while clerks may need mutable case-management tools. Audience-scoped tool catalogs, separate identities, and least-privilege bindings prevent a public-facing agent from invoking write operations on sealed or sensitive dockets even if a prompt tries to coerce that behavior.

Recording detailed audit logs for public FAQ agent docket tool calls for compliance review only records what happened after the fact; it does not prevent the public FAQ agent from invoking those mutation tools in the first place.

Applying response filtering to public FAQ agent outputs referencing internal docket records checks what the agent says after it generates a reply, but it does not block the agent from calling mutable docket tools or stop a write operation before it occurs.

Configuring public FAQ agent system-prompt instructions defining permitted docket tool use is a soft control a crafted prompt can bypass, unlike permission-layer separation that blocks the mutation tools outright.

Exam caveat: agent governance questions often hinge on tool-access separation by role or audience, not on model size or prompt tone alone. Operational check: inventory tools bound to the public FAQ agent and assert that create/update/delete docket APIs are absent; attempt a prompt that requests sealing or editing a case and confirm the agent cannot call those tools.