Tools with consequence: the three tiers
Decide what an agent may hold before it holds anything — and why withholding is a structure while instructing is a wish.
An agent’s authority is not what its instructions say. It is the list of tools attached to it. Everything else is a preference.
Lesson 3 gave you the tiers. This is the design decision they exist for, and it is made before the agent is built, on one question: what is the smallest set of tools that can resolve this ticket?
The refund desk, tool by tool
| The agent needs to… | Tier | Decision |
|---|---|---|
| read the policy — Search Knowledge Base | read | attach. It cannot decide anything without the rules. |
| read the account — Database Query, pinned read-only | write_internal | attach. The policy is undecidable without the record. |
| issue the refund — CRM Manager | write_internal | withhold. This is the whole argument of the course. |
| tell the customer — Send Template Message | external_irreversible | withhold, and note what that saved in a moment. |
read the policy — Search Knowledge Base
- Tier
read- Decision
- attach. It cannot decide anything without the rules.
read the account — Database Query, pinned read-only
- Tier
write_internal- Decision
- attach. The policy is undecidable without the record.
issue the refund — CRM Manager
- Tier
write_internal- Decision
- withhold. This is the whole argument of the course.
tell the customer — Send Template Message
- Tier
external_irreversible- Decision
- withhold, and note what that saved in a moment.
Withholding is a structure. Instructing is a wish.
There is a real and enormous difference between an agent that holds a refund tool and is told not to use it, and an agent that has no refund tool. Only the second one is a boundary. The first is a request, evaluated by the same machinery that decides everything else it does, on a run you are not watching.
You have already seen this work. In lesson 1, the agent announced that it had notified the account manager and would now email the customer — and drafted the email. Neither thing happened, and nothing in its instructions prevented them. They did not happen because it had no tool that sends anything. That is the only control in that entire run that held.
The rule from lesson 3, restated as an instruction to yourself: to lower an agent’s tier, remove a tool. Never add a sentence.
Where the action goes instead
Withholding the refund tool does not mean no refund can ever be issued. It means the issuing does not happen inside the agent. In the finished build the write is a separate step, downstream of a reviewer and a human approval, and it is the only step in the canvas that changes anything.
The question to ask of any agent you are about to ship. Not “is the prompt good?” but: if this thing became briefly, confidently insane on one run out of two hundred, what is the worst it could do with the tools attached to it? That number is your exposure, and it is a property of the tool list.
Related lessons
Base rates — what a piece of evidence is actually worth
A face-recognition system that is 99.9% accurate and almost entirely wrong, and a number that sent an innocent woman to prison. Both are the same arithmetic, and it is the arithmetic that decides what any piece of evidence is worth.
ReadConfirmation and survivorship — what you never looked for
Two questions about evidence you did not go looking for. One is a rule you have to discover, and one is a pattern in five famous people — and in both, the thing that would have told you the truth is the thing nobody checks.
ReadLoss aversion, sunk cost and regression — what it costs you
Four questions you answer about yourself rather than about a scenario, and your own answers are the finding. Then the pattern that makes praise look useless and criticism look like it works, whatever you actually do.
Read