Everything an AI agent says is just text until it makes a tool call. The tool call is where text turns into an action against a real system. That's why the tool list is the real permission list, and why an agent nobody has scoped can do far more than the person who set it up expected.
What a tool call carries
The name of the tool, like send_email or run_query
The arguments the agent chose, such as who the email goes to
The credential the call runs under, which is almost never the agent's own
The result the tool sent back, which the agent then reads and acts on
Where teams get it wrong
Teams review the prompt and skip the tool list. The prompt shapes what the agent tries. The tool list decides what it can actually reach. A careful prompt in front of a wide tool list is a request, not a control.
Here's a concrete one. An agent is given read access to a ticketing system so it can summarize open work. The same API token also allows writes, because that's the token the team already had. Nobody asked for write access and nobody granted it on purpose. The agent has it anyway, and one bad tool call is all it takes to use it.
Scope the tools first. Then write the prompt.