A production agent passes functional tests but can invoke tools outside its assigned compartment. What is required before rollout?

1. Narrow IAM and tool permissions and retest prohibited operations
2. Add a disclaimer while leaving broad permissions
3. Hide the tool list from users without changing permissions
4. Increase output-token limits