Module · M3 · Give it hands, and meet the problem
Tools with consequence: the three tiers
Lesson 8 of 21 · 7 min
An agent’s authority is not what its instructions say. It is the list of tools attached to it. Everything else is a preference.
Lesson 3 gave you the tiers. This is the design decision they exist for, and it is made before the agent is built, on one question: what is the smallest set of tools that can resolve this ticket?
The refund desk, tool by tool
| The agent needs to… | Tier | Decision |
|---|---|---|
| read the policy — Search Knowledge Base | read | attach. It cannot decide anything without the rules. |
| read the account — Database Query, pinned read-only | write_internal | attach. The policy is undecidable without the record. |
| issue the refund — CRM Manager | write_internal | withhold. This is the whole argument of the course. |
| tell the customer — Send Template Message | external_irreversible | withhold, and note what that saved in a moment. |
read the policy — Search Knowledge Base
- Tier
read- Decision
- attach. It cannot decide anything without the rules.
read the account — Database Query, pinned read-only
- Tier
write_internal- Decision
- attach. The policy is undecidable without the record.
issue the refund — CRM Manager
- Tier
write_internal- Decision
- withhold. This is the whole argument of the course.
tell the customer — Send Template Message
- Tier
external_irreversible- Decision
- withhold, and note what that saved in a moment.
Withholding is a structure. Instructing is a wish.
There is a real and enormous difference between an agent that holds a refund tool and is told not to use it, and an agent that has no refund tool. Only the second one is a boundary. The first is a request, evaluated by the same machinery that decides everything else it does, on a run you are not watching.
You have already seen this work. In lesson 1, the agent announced that it had notified the account manager and would now email the customer — and drafted the email. Neither thing happened, and nothing in its instructions prevented them. They did not happen because it had no tool that sends anything. That is the only control in that entire run that held.
The rule from lesson 3, restated as an instruction to yourself: to lower an agent’s tier, remove a tool. Never add a sentence.
Where the action goes instead
Withholding the refund tool does not mean no refund can ever be issued. It means the issuing does not happen inside the agent. In the finished build the write is a separate step, downstream of a reviewer and a human approval, and it is the only step in the canvas that changes anything.
The question to ask of any agent you are about to ship. Not “is the prompt good?” but: if this thing became briefly, confidently insane on one run out of two hundred, what is the worst it could do with the tools attached to it? That number is your exposure, and it is a property of the tool list.