- Panelists on AI Engineer argued that giving an agent fewer tools and a clear mission cuts its errors and its wasted effort.
- The panel gave no measurements, and the approach is described as early, so treat it as a claim to test.
Limiting what an AI agent can do is usually pitched as a security cost. Panelists on the AI Engineer show argued it also helps the agent work better. Michael Davis, Global Chief Security Architect at JPMorgan Chase, said fewer options lead to better decisions. The discussion was moderated by Keycard's Allie Howe, in an episode about an agent that got its user banned from Resy.
What was said
The show notes tell of an agent booking a restaurant. Over 90 minutes it placed 200 calls, and Resy banned the user it worked for. The agent's aim was good, but nothing capped its behavior.
The panel's answer was to define the agent's intent, meaning the mission it is on, and give it only the tools that fit. A speaker on the show described taking tools away on the fly. While an agent writes an email, for example, you switch off web search and other outbound tools. You turn them back on once that step is done.
A second speaker linked this to MCP, a common way of connecting agents to tools. One big complaint about MCP was context bloat, where too much material crowds the agent's working memory. This speaker said: "intent also will result in us spending less tokens because the agent will spend time doing less things that aren't the right pathway."
Davis made the same case from the authorization side. He said these controls reduce not just security issues but the agent's plain error rate. In his words: "When you have less things the agent can do, it makes better decisions."
Why it matters
Our reading: this changes how a buyer or builder should judge agent controls. Scoping tools to a task is not only a rule for the security team. It may also be a way to cut errors and token costs, which budget holders already track.
Davis said engineers are now part of the authorization conversation. He also said security and application teams can use the same language about it. So a useful question for any agent product is whether its tools can be narrowed per task, not only whether it has access.
The other side
The panel gave no measurements. Davis spoke of real-world cases where the agent loop worked better but named none. The speaker on dynamic tool removal called these ideas complicated and still early. Two of the four people on stage work for Keycard, and the episode offers no independent test.
Limits also have a price. The second speaker said a constrained agent may reach a point and report that it cannot do the task. Davis added that human approval is not a cure-all, because people get fatigued. The challenge is to bring them in only when it matters.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- AI Engineer: An AI Agent Got Its User Banned From Resy — Keycard, JPMorgan Chase & AAuth (2026-10-17)
