Module 5 • Lesson 40• 35 mins

Tool Scoping and Minimal Tool Surface

Establish Minimal Tool Surfaces and granular permissions to constrain Blast Radius, decoupling architectural boundaries from behavioral Autonomy.

Apply Minimal Tool Surface principles and granular Read/Write scopes

Decouple architectural Tool Scoping from behavioral Autonomy Levels

Tool Scoping and Minimal Tool Surface

In AI Literacy Lesson 11, you learned about Tool Use and Function Calling — the mechanism allowing AI models to invoke external tools and perform concrete actions. The next strategic step for a Product Manager is answering: "Across dozens of APIs and databases in our infrastructure, which tools should we connect to our agent, and how should their permissions be bounded?"

Running example: IT-DeskBot — an agent automating internal IT support and incident resolution for employees via Slack.

1. Tool Surface, Minimal Tool Surface, and Scoped Permissions

To safely govern an agentic product, PMs must master 3 core concepts:

Tool Surface: The entire catalog of tools, APIs, and databases an agent is permitted to discover and invoke throughout its lifecycle.
Minimal Tool Surface: The foundational principle of granting strictly the minimum set of tools required for the product objective, refusing to provide extra tools "just in case."
Per-Tool Scopes & Permissions: The specific authorization tier of each tool (e.g., Read-only query tools vs. Write/Update mutation tools, tenant-isolated data vs. global administrative access).

Tool Surface, Minimal Tool Surface & Blast Radius

Audit IT-DeskBot tools to evaluate the boundary between minimal surface and over-scoping hazards.

Select a tool to inspect permissions & blast radius:

edit_user_permissions(user_id, role)Blast Radius: Severe (5/5) - OVER-SCOPING

If manipulated via prompt injection, an attacker could instruct the agent to grant root admin access.

Defense-in-Depth Principle

Tool Scoping is an architectural physical barrier. Even if behavioral autonomy logic is bypassed, an agent cannot destroy what it physically lacks tools to touch.

Excluding high-risk tools from the Tool Surface is the only reliable way to constrain blast radius against Prompt Injections.

2. The Twin Pitfalls: Under-scoping and Over-scoping (Blast Radius)

When architecting a Tool Surface, PMs frequently fall into two extremes:

Under-scoping: Severely restricting the agent such that it lacks the tools required to complete basic tasks, causing frequent halted workflows and user frustration.
Over-scoping: Granting excessive administrative permissions. If the agent hallucinates, errors, or falls victim to Prompt Injection, its blast radius (maximum potential catastrophic damage) is enormous.

Concrete Example: IT-DeskBot's mandate is looking up ticket statuses and assisting with employee self-service password resets. The enterprise IT stack includes admin APIs like edit_user_permissions and delete_account. If the PM over-scopes by granting these tools "for future convenience", a prompt manipulation attempt could trick the agent into granting root admin privileges to an unauthorized user or wiping corporate user accounts.

3. Decoupling Tool Scoping (Architectural) from Autonomy Level (Behavioral)

Many PMs conflate Tool Scoping with Autonomy Levels (introduced in AI Literacy Lesson 12 and expanded in Lesson 42):

Dimension	Control Layer	Operating Mechanism
Autonomy Level	Behavioral Layer	How freely the agent can make decisions before requiring human approval.
Tool Scoping	Architectural Layer	Whether the agent has physical connectivity to the tool in the first place.

This is the principle of Defense-in-Depth: Even if behavioral autonomy logic is bypassed or suffers a software bug, the agent cannot inflict harm because, at the architectural layer, the dangerous API is physically excluded from its tool surface.

A note on MCP (Model Context Protocol): When collaborating with engineers (or as covered in AI Agents for PM Day 6), you will encounter MCP — an open standard protocol enabling agents to connect securely to data sources and tools. From a PM perspective, MCP is the technical infrastructure executing your defined Tool Surface and Scope specifications.

4. Analogy: Keycard Access Control vs. Master Skeleton Key

Designing a Tool Surface is identical to issuing corporate facility keycards:

Master Skeleton Key (Over-scoping): Giving an intern a key opening the CEO's office, server rooms, and payroll archives. If stolen or lost, the entire company is compromised.
Departmental Keycard (Minimal Tool Surface): The IT helpdesk technician gets a badge opening only the tech bay and parts cabinet. Even if tricked or compromised, damage is strictly confined within a safe perimeter.

Exercise 40.1: You are designing SupportBot for an e-commerce platform. Backend engineering proposes granting the following 5 APIs to the Agent:

get_order_status(order_id): Order tracking lookup (Read-only).
check_refund_eligibility(order_id): Return policy verification (Read-only).
issue_discount_voucher(user_id, amount): Issues apology coupons up to $2.00 (Write).
update_shipping_address(order_id, new_address): Modifies delivery destination (Write).
delete_customer_account(user_id): Deletes customer profiles upon request (Delete).

Analyze which APIs constitute a valid Minimal Tool Surface, which represent dangerous Over-scoping, and specify your adjusted permission scopes.