How to Assign Tools to Different Agents

A team I know gave every agent access to every tool — read, write, delete, send, everything — because it was simpler than figuring out who needed what. It worked until a summarizer agent, confused by a malformed instruction, called a delete-table tool it had no business having and dropped a production table. The summarizer never should have been able to touch that tool. That incident is why multi agent tool assignment is a security decision, not a convenience one, and this guide shows how to do it right with patterns you can apply today.

Quick-start (copy this right now)

Here's the core pattern: assign each agent the minimum tools its role requires, and enforce it at the dispatch layer so an agent physically cannot call a tool it wasn't granted.

AGENT_TOOLS = {
    ,[object Object],:  {,[object Object],, ,[object Object],},          ,[object Object],
    ,[object Object],:     {,[object Object],, ,[object Object],},            ,[object Object],
    ,[object Object],:      {,[object Object],},                         ,[object Object],
    ,[object Object],:   {,[object Object],},                        ,[object Object],
}

,[object Object], ,[object Object],(,[object Object],):
    allowed = AGENT_TOOLS.get(agent_name, ,[object Object],())
    ,[object Object], tool_name ,[object Object], ,[object Object], allowed:
        ,[object Object], PermissionError(
            ,[object Object],)
    ,[object Object], tool_name ,[object Object], DESTRUCTIVE ,[object Object], ,[object Object], args.get(,[object Object],):
        ,[object Object], PermissionError(,[object Object],)
    ,[object Object], TOOLS[tool_name](args)

What this does: it defines a least-privilege tool set per agent and enforces it in code at dispatch, so an agent can only call tools its role explicitly grants and destructive tools require human approval regardless of role — turning tool assignment from a hope into a hard boundary.

The principle is least privilege, borrowed straight from security engineering. Each agent gets exactly the tools its job requires and nothing more. The summarizer that deleted a table couldn't have, under this pattern, because delete was never in its set. Multi agent tool assignment done this way makes whole categories of failure impossible rather than merely unlikely.

Understanding the variables

Three variables govern safe tool assignment.

The first is tool blast radius — how much damage a tool can do if misused. Read tools have small blast radius; a wrong read wastes a call. Write tools have larger radius; a wrong write corrupts data. Delete and send tools have the largest; a wrong delete or send is often irreversible. Assign high-blast-radius tools to as few agents as possible, and gate them behind human approval regardless of which agent holds them.

The second is role-tool fit — whether an agent's job actually requires a tool. A writer needs to read source material; it does not need to run database queries or delete files. The discipline is to grant a tool only when the role genuinely can't function without it. "It might be useful" is not a reason; "the role fails without it" is.

The third is the approval gate — which tool calls require a human before executing. This is orthogonal to assignment: even an agent permitted to use a destructive tool should trip a human approval for it. Assignment controls who can attempt a tool; the gate controls whether the attempt executes. Both matter, and the gate is your last line of defense.

⚡ Pro tip: default every new agent to zero tools and add them one at a time as you prove each is needed. Starting from "no tools" and justifying each addition produces tight, safe tool sets. Starting from "all tools" and trying to remove the dangerous ones always leaves something over-privileged, because it's hard to prove a tool isn't needed. The direction you start from determines whether you end up least-privilege or over-privileged.

Step-by-step: assigning tools safely

Start by listing every tool and its blast radius. Sort them into read (small), write (medium), and destructive or external-effect — delete, send, pay, publish (large). This classification drives every assignment decision, so get it right before assigning anything.

Next, for each agent, write down the single sentence describing its job, then grant only the tools that sentence requires. A researcher's job is "find and read relevant information," which needs search and read, full stop. If you find yourself granting a write tool to an agent whose job sentence is about reading, stop — that's the over-privilege creeping in.

Then wire enforcement at the dispatch layer, not in the prompt. A tool restriction in a system prompt is a suggestion the model can be talked past by a malformed or adversarial instruction. A restriction in the dispatch code is a wall no prompt can breach. This is the step teams skip, and it's the one that would have saved the deleted table.

Finally, add human-approval gates on every destructive and external-effect tool, independent of assignment. Even the publisher agent that's allowed to post should route its post through a human on the first pass, until you trust it. The gate and the assignment together give you defense in depth — two independent barriers, either of which stops the failure.

⚠️ Common mistake: enforcing tool restrictions only in the prompt. "You may only use the search tool" in a system prompt is not a security boundary — it's a polite request the model will violate when an instruction, malformed or adversarial, pushes it to. Real multi agent tool assignment enforces permissions in code at the dispatch layer, where the model's reasoning can't override them. Prompt-level restrictions are for clarity; code-level restrictions are for safety, and you need the latter.

Pro-level variations

Once basic assignment is solid, three variations harden it further.

Add dynamic tool scoping, where an agent's tools narrow based on context. An agent handling a low-trust input gets a smaller tool set than the same agent handling a trusted one, shrinking the blast radius exactly when risk is highest.

[object Object], ,[object Object],(,[object Object],):
    base = AGENT_TOOLS[agent_name]
    ,[object Object], trust_level == ,[object Object],:
        ,[object Object], base & READ_ONLY          ,[object Object],
    ,[object Object], base

What this does: it dynamically removes write capabilities from an agent when it's processing low-trust input, so a prompt-injection attempt arriving through untrusted data hits an agent that literally can't perform a damaging action.

Add per-tool rate limits so even a permitted tool can't be called in a runaway loop. And add an audit log of every tool call with agent, args, and outcome, so any incident is fully reconstructable and you can spot an agent drifting toward tools it shouldn't need.

⚡ Pro tip: treat any agent that processes untrusted external input as compromised by default, and give it read-only tools. Prompt injection through external content is a real attack, and the agent reading a web page or a user email is the one most likely to receive a malicious instruction. Assuming that agent will eventually be hijacked, and ensuring it holds no destructive tools, means a successful injection can read but not wreck. This single assumption prevents the worst tool-assignment disasters.

Troubleshooting common issues

If an agent can't complete its job, you may have under-granted — but check whether the job actually needs the missing tool or whether the job should be split so a different, appropriately-privileged agent handles that part. Often the fix is delegation, not more tools.

If you're nervous about a destructive tool, don't remove it from the agent that needs it — gate it behind human approval instead. Assignment plus gating lets a capable agent hold a powerful tool safely.

If tool sprawl is making assignment hard to reason about, you have too many tools or too coarse a classification. Consolidate tools and sharpen the blast-radius buckets.

If an injection incident occurs, check whether the compromised agent had any write or destructive tools it didn't strictly need — the fix is almost always to have processed untrusted input with a read-only agent.

⚡ Pro tip: review your tool assignments whenever you add an agent or a tool, not just at build time. Tool sprawl accumulates silently — a tool added for one agent gets copied to another "to be safe," and over-privilege creeps back in. A periodic assignment review, checking that every agent still holds only what its job sentence requires, keeps the least-privilege discipline from eroding the way it always tries to. Treat it like a security audit, because that's what it is.

How does multi agent tool assignment stop injection damage?

The deleted-table story was an accident, but the same weakness is a deliberate attack surface, and this is where careful multi agent tool assignment stops being hygiene and becomes your primary defense against prompt injection. When an agent processes external content — a web page, a user email, a document — that content can carry a malicious instruction, and if the agent holds a destructive tool, the instruction can weaponize it.

The defense is architectural, not clever prompting. You cannot reliably prompt an agent to ignore injected instructions; attackers are creative and the model is persuadable. What you can do is ensure the agent that reads untrusted content simply doesn't hold any tool that could cause damage. An injection that reaches a read-only researcher can waste a search call and nothing more. The same injection reaching an agent with a send or delete tool is a breach. The tool set, not the prompt, is what bounds the damage.

This maps to a clean rule: separate the agent that reads untrusted input from the agent that takes consequential action, and give the reader no consequential tools. The reader ingests and summarizes; a separate, more privileged agent acts only on the reader's sanitized output, never on the raw external content. The injection can corrupt what the reader reports, which is a smaller and more detectable problem than the injection directly commanding an action.

[object Object], ,[object Object],(,[object Object],):
    ,[object Object],
    summary = reader_agent(untrusted_content, tools=READ_ONLY)
    ,[object Object],
    ,[object Object], actor_agent(summary, tools=ACTOR_TOOLS, gated=,[object Object],)

What this does: it routes untrusted content only through a read-only reader and lets a separate gated actor work from the sanitized summary, so an injected instruction can never reach an agent capable of a damaging action — the architectural boundary that prompting alone can't provide.

⚡ Pro tip: trace every consequential tool call back to whether untrusted content influenced it, and flag any that were. A send or delete whose inputs trace back to external content is exactly the path an injection would exploit, so surfacing those calls for review catches attacks that slipped past your assignment rules. This provenance check is a cheap second layer behind least-privilege, and it's the one that catches the injection your tool assignment didn't anticipate.

Your turn

Take your current multi-agent system and write out every agent's tool set next to its one-sentence job description this week. Any tool that doesn't match the job sentence is over-privilege to remove — and you'll likely find at least one summarizer that can delete something it never should.

As you develop tool-assignment maps and approval-gate rules that fit your system, save them in PromptABCD alongside your agent prompts. Safe multi agent tool assignment is a discipline that degrades without a source of truth, and keeping the assignments versioned in one place is how you keep "least privilege" from quietly drifting back to "every tool, for flexibility" the next time someone's in a hurry.