An agent has content guardrails but a tool can update any customer's account. What additional control is required?

1. A larger context window
2. Tool-side authorization restricting the operation to permitted records
3. A second copy of the same unrestricted tool
4. More decorative warning text