An agent has a shipment lookup tool and a refund tool. A user asks only where a package is. Which tool-access design reduces unintended business changes?

1. Assume every model call is a deliberate user command
2. Separate read and write tools, restrict permissions, and require appropriate authority for refunds
3. Give every lookup request unconditional refund authority
4. Hide the refund tool's name while leaving unrestricted execution available