An agent has access to many tools but only two are needed for the current approved task. Which approach best fits?

1. Use stable operation identifiers and idempotent tool handling.
2. Resolve the secret inside trusted execution code using controlled runtime access.
3. Expose or authorize only the required tool subset for that task.
4. Treat tool output as untrusted data and preserve session authorization.