Patrícia asked the email assistant to "clean out the spam." It deleted 112 emails and emptied the trash. Hours later, it confirmed payment details to a supposed supplier; the next day, it sent the price list to 640 contacts. That power came as the tool's default. In this lesson, you write the contract that limits each tool to the minimum.
1Separate reading, preparing, writing, and what never goes out without approval
2Scope and limit: which records, fields, destinations, and amounts
3Credential stored outside the text, with the agent's own identity
4Repeat without duplicating, errors with a destination, and a record of every action
Goal: give each of the agent's tools the minimum access: read or write, scope, limit, credential outside the prompt, log, and who approved it.
01 · The access ladder
Each operation of a tool sits on a step. Start at the bottom and move up only with a written reason. Click each step.
Click each block in the diagram to see what it does.
Module 5 of the Gestoria method (INEMA): reading × writing and minimum scope. The steps match the colors of the G3 authority limit (green, yellow, red). Horizonte: fictional study company.
02 · A tool's contract
Four rules that fix Horizonte's email assistant (F9 in the lab). You decide; IT configures and confirms.
1. List what it can do
Ask IT, or the vendor, for the list of all the operations the tool allows. The risk is in what it can do, not in what you imagined it would do.
For each operation, choose the step. The factory default is usually the most open, because that way the tool "works right out of the box".
F9 in the labScopes: read, send, delete, move, and read contacts. Automatic approval to read, send, reply, delete, and empty the trash. Human approval: off. Approved by: "you can turn it on", from Carlos, over WhatsApp.
2. Scope and limit
Write down the reach of each operation: which records (only the customer in the conversation), which fields (no CPF), which destinations (only whoever wrote in), which amounts (up to R$ 5 mil).
Ask that the limit live in the tool, not just in the instructions. The sentence "never give more than 5%" in the agent's text is a request; the ceiling set in the orders app is a lock.
At Horizontecriar_pedido: registered customer, current price-list price, discount up to 5%, amount up to R$ 5 mil. Above that the tool only accepts a draft, which waits for Patrícia.
3. Credential outside the text
The password or access key is stored on the server or in a password vault, never in the agent's instructions, in a spreadsheet, or in the browser. Everything that goes to the browser is public, as the key exposed in the lab's orders app shows (F1).
The agent uses its own named access, not Patrícia's password. That way the log says who did it, and you can cut off the agent without cutting off the person.
At HorizonteThe comercial@ mailbox gets a read-only access called "hora-email", kept by Rafael in the vault. The old key, which circulated in a configuration file, is replaced.
4. Retry without duplicating
If the connection drops and the agent tries again, the order cannot go out twice. Ask IT for a unique key per operation (the conversation number and the order version); if the key repeats, the tool refuses.
Define how many attempts, how long to wait, who gets the error along with the context, and the log of each action. Connectors change: on 07/28/2026, a new MCP version that breaks old servers was reported (secondary source, not confirmed; check it). The contract on paper is what you use to redo and test.
At Horizontecriar_pedido: at most 2 attempts, 30 seconds of wait; if it fails, the case goes to Juliana with the conversation and the draft. Every call is logged with conversation, amount and version.
03 · Template to copy: tool contract
One contract per tool, on one page. The tab next to this one shows Hora's two contracts and the corrected F9.
Tool contract
TOOL CONTRACT · <name> · agent <...> · version <...> · date <...>
Owner (business): <name> · Configures and confirms (IT): <name>
WHAT IT CAN DO (list from IT/vendor, complete):
| Operation | Effect outside the company? | Step (read / draft / write within a limit / out) |
|---|---|---|
| <...> | yes/no | <...> |
SCOPE: records <...> · allowed fields <...> · forbidden fields <...>
ALLOWED DESTINATIONS: <...>
LIMITS IN THE TOOL (not only in the text): <amount, quantity, recipients>
APPROVAL: <who> · on the exact content · deadline <...>
CREDENTIAL: the agent's own access "<access-name>" kept in <vault/server>
(never in the prompt, the spreadsheet or the browser) · replaced every <period>
RETRY: unique key = <...> · attempts <n> · wait <s>
ERROR: goes to <name> with <conversation, draft, reason>
LOG: <what is recorded> · kept for <period>
APPROVED BY: <name, date, in this document> (a "go ahead" message does not count)
Prompt · what the tool does that the contract doesn't say
You are a process security reviewer. Below are the list of
operations a tool allows (from the documentation or the
configuration) and the contract that limits how an AI agent uses it.
Do not configure anything: point things out.
1. Which operation does the tool allow that the contract doesn't mention?
2. Is anything that can't be undone (deleting, paying, sending to many people)
within the agent's reach?
3. Does any limit exist only in the text and not in the tool?
4. Does the credential appear anywhere visible?
5. What happens if the same action is repeated by mistake?
Operations / configuration:
"""<paste>"""
Contract:
"""<paste>"""
Simulation: illustrative example
Hora · contracts v1 · Horizonte, fictional study company · owner: Patrícia · IT: Rafael
consultar_cliente · read · only the customer of the phone number in the conversation · fields: legal name, CNPJ, registered delivery address, payment terms · forbidden: CPF, other customers · every lookup is logged.
criar_pedido · write within a limit · registered customer, current list price, discount up to 5%, amount up to R$ 5 thousand (locked in the app) · above that: draft only, Patrícia's approval within 2 business hours · unique key: conversation + order version · 2 attempts · error goes to Juliana · access "hora-pedidos" in Rafael's vault · approved by Carlos in this document.
Stay: read the comercial@ mailbox and read contacts (read step).
Become a draft: reply and send. Patrícia approves each send; one recipient at a time; no entire lists.
Leave the agent: deleting email, emptying the trash, bulk moving. Spam gets flagged; a person does the deleting.
Human approval: on. Credential: key replaced, own access "hora-email" in the vault.
What has already happened: the email changing a bank account becomes an incident (finance confirms by phone with the supplier); the emptied trash is requested from the email provider, if still possible; the 640 contacts get a correction if the table was wrong.
Approved by: Carlos, in the contract, after reading it. The "go ahead" by WhatsApp does not count as approval.
04 · Practice
Hora's contracts and the F9 fix for practice; a tool of your own for real.
1 · Two contracts and the F9
35 min
Open Hora's configuration and write the contracts for consultar_cliente and criar_pedido using the template. Then open the lab's email assistant, read the configuration and the log of the latest actions, and write the corrected contract: what stays, what becomes a draft, what leaves the agent, and what to do about the four actions already logged.
Done when: there are 3 contracts (2 for Hora and 1 for the email), each operation has a step, no delete or empty within the agent's reach, a numeric limit on every operation involving amounts or recipients, a credential with its own access and a storage place, a key against repeats in criar_pedido, and a remedy for each of the 4 logged actions.
2 · A tool of your own
40 min
Choose the most powerful tool that an agent or automation uses in your process (email, ERP, CRM, shared spreadsheet). Ask IT or the vendor for the complete list of operations. Write the contract and run the review prompt. Hand it to IT and ask for written confirmation of the locks.
Done when: the contract has the complete list of operations with a step, scope, limits that exist in the tool, a credential kept out of the text, the destination of errors and the log, and you have written confirmation from IT (or the list of what still needs to be configured, with a deadline).
5 questions. The explanation appears after your attempt.
Question 1 of 5
The email assistant was turned on with automatic approval to delete and empty the trash. Who decided that?
Correct
Approval applies to exact content. "Go ahead" said nothing about deleting or sending. The contract exists so that someone decides, operation by operation, and signs.
Not that one
Approval applies to exact content. "Go ahead" said nothing about deleting or sending. The contract exists so that someone decides, operation by operation, and signs.Review: A tool's contract
Question 2 of 5
Hora's instructions say "never give more than 5% discount". Is that enough?
Correct
An instruction is a request; a lock in the tool is a limit. F6's hidden order shows that text pasted by the customer can override what is written in the agent.
Not that one
An instruction is a request; a lock in the tool is a limit. F6's hidden order shows that text pasted by the customer can override what is written in the agent.Review: The access ladder
Question 3 of 5
Where is the password the agent uses to access the order app kept?
Correct
What is in the instructions, a spreadsheet or the browser can leak. Its own access also makes the log say "it was the agent" and lets you cut it off without affecting Patrícia.
Not that one
What is in the instructions, a spreadsheet or the browser can leak. Its own access also makes the log say "it was the agent" and lets you cut it off without affecting Patrícia.Review: A tool's contract
Question 4 of 5
The connection dropped in the middle of an order and the agent tried again. What does the contract need to guarantee?
Correct
Retrying is normal; duplicating is damage. The unique key (conversation + request version) makes the tool refuse what it has already done, and the error goes to a person with the context.
Not that one
Retrying is normal; duplicating is damage. The unique key (conversation + request version) makes the tool refuse what it has already done, and the error goes to a person with the context.Review: A tool's contract
Question 5 of 5
A new connector version that breaks the old ones was announced. Why does the contract on paper help?
Correct
The news about MCP comes from a secondary source and needs to be verified, but the point holds for any connector: it changes, and the contract is the reference for checking that nothing now has more access than it should.
Not that one
The news about MCP comes from a secondary source and needs to be verified, but the point holds for any connector: it changes, and the contract is the reference for checking that nothing now has more access than it should.Review: A tool's contract
Quiz complete
You got {a} of {n} right. Get them all right and the lesson is marked as complete.
Pick one answer. The explanation shows up after you try.
06 · Summary
Access ladderRead, draft, write within a limit. Deleting, paying and mass sending stay out.
Full listThe risk is in what the tool can do, not in what you intend to do.
Lock outside the textLimit in the tool, credential in the vault, access under the agent's name.
Retry, fail, logUnique key, retries, where the error goes, and a log of every action.
