Topic
Restricting an action-capable model to an allowlist of argument-validating functions and the smallest capability set the task requires.
A builder audited the human-in-the-loop gate on his own MCP write tool and found a keyword argument the caller sets. Optional evidence makes an optional check.
Reality
Three near-identical skills on Claude Code v2.1.263 show that context: fork isolates the conversation and leaves the filesystem alone, because the subagent still holds Read and Bash, at roughly five times the token cost.
Reality
Once the client-side contract is a URL and a bearer header, nothing in your config records what that key may write. The decision moved to the mint screen, which is the screen easiest to skip.
Reality
A dev.to essay splits agent architecture into five control layers and shows that only one of four failures in its worked example is fixable by editing instructions.
Reality
A dev.to argument worth taking literally: if your model reads untrusted text and can act, injection is already live. The only controls that held up sit outside the prompt.
Reality