Principle
Prefer a task-shaped tool to an open-ended one
A function named `create_invoice_draft` has fewer dangerous interpretations than `run_anything`.
When it fits
- An agent can accomplish a job either through a narrow function or through a general shell, browser or arbitrary-request tool.
When to avoid it
- Over-fragmented tools can make workflows brittle; use the narrowest interface that still represents the real job.
Why it matters
When practical, expose a function whose inputs and effects match the intended action instead of an open-ended executor. Narrow tools make authorization, validation, logging and testing more specific. General tools remain useful for expert work, but they deserve stronger containment because their action space is much larger.
An example
Use a repository file-update function for a known path rather than giving a content agent an unrestricted shell.
Check your result
The chosen tool exposes no broad capability merely because it was easier to integrate.
Keep this limit in mind
- Over-fragmented tools can make workflows brittle; use the narrowest interface that still represents the real job.
Evidence and sources
OWASP recommends avoiding open-ended agent extensions where more granular task-specific functionality can be used.
General tools may be justified for expert workflows, but they require stronger containment and authorization.
LLM06:2025 Excessive Agency · Avoid open-ended extensions