A research system's coordinator has access to ten tools: Task, Read, Write, Edit, Bash, web_search, web_fetch, lookup_database, send_email, and schedule_meeting. The synthesis subagent inherits all ten tools by default. Recently the synthesis subagent decided to email the synthesis output to the user — which was both surprising and inappropriate.
What's the right fix?
Why did you pick that answer? Two or three sentences. The act of articulating it is what builds the judgment — not the click that follows.
Restrict subagent tool sets to their role. A synthesis subagent doesn't need the ability to send email; giving it access invites the misuse you just observed. The AgentDefinition is where role-appropriate tool surfaces are defined — use it. The principle: subagents should have exactly the tools their role requires, and nothing more. This is access control, applied to agents.
Telling the agent never to call a tool is probabilistic compliance on a deterministic concern. The agent is more likely to follow the rule than not, but "more likely" isn't a guarantee — and you've already seen the violation.
A PreToolUse hook can block specific calls, but you'd be adding runtime infrastructure to enforce something that the simpler AgentDefinition mechanism already enforces structurally. Hooks are right for cross-cutting policy enforcement; tool-set scoping is right for role-based access.
A scary tool name is security through obscurity. The agent will still see it as a callable tool. Real access control means the tool isn't there to call.