A courts public FAQ agent must help residents find information but must never mutate case records. How should its tools be constrained?

A courts public FAQ agent that helps residents find information but must never mutate case records should allow only read-only search tools and deny any tools that mutate case records. Least-privilege tool design is the control: public FAQ traffic can retrieve published statuses or guidance, but create/update/delete on dockets stays off the tool list entirely. That constraint matches the civic risk model for courts—information help without write paths into case systems. Allowing read-only search tools with sensitive cases screened by prompt instructions still relies on prompt-level screening to protect non-public cases, and prompt instructions are not a reliable enforcement boundary for anonymous public traffic. Allowing read-only search tools through direct full docket database queries still bypasses the controlled search interface and risks exposing non-public case details beyond what the published-records policy allows. Allowing read-only clerk case-management tools for public FAQ search needs still brings internal tools into a public-facing channel and risks exposing non-public details beyond what the scoped public search API allows. On the exam, read-only search through a scoped API with mutation tools denied is the correct constraint; distractors are read-only search with sensitive cases screened only by prompt instructions, broad search through direct full docket database queries, or read-only clerk case-management tools for public FAQ traffic. Caveat: read-only still requires careful redaction—some case details are not public even if searchable internally; align tools with published-records policy. Operational check: inventory agent tools, ensure only the scoped read/search API is registered, attempt a mutation request in test and confirm refusal, and verify no broad database read or write credentials are attached to the FAQ runtime.