Too many tools degrades selection. Going from a tight 4-5 tool set to something like 18 measurably raises decision complexity and reliability drops — this isn't a vague intuition, it's a named, testable effect. Agents also misuse tools outside their intended specialization whenever they're available: hand a synthesis agent a web-search tool, and it will search instead of synthesizing the findings it was already given.
Reliability doesn't degrade evenly — it holds up well in a tight tool set and drops off as the set grows, which is why scoping by role beats granting broad access "just in case."
Practices worth internalizing:
- Scope each agent's tools to its role. A synthesis agent needs synthesis tools, not general-purpose research tools it might be tempted to reach for.
- Replace generic tools with constrained alternatives.
fetch_urlbecomesload_document, which validates that the target is actually a document — narrower, and it removes a whole category of misuse. - Provide scoped cross-role tools for genuine high-frequency needs. A narrow
verify_facttool on a synthesis agent, for its occasional simple lookups, while complex verification still routes through the coordinator — this is least privilege applied with a pragmatic exception, not an all-or-nothing choice between full access and constant round-trips.
tool_choice settings and what they're for:
| Setting | Behaviour | Use for |
|---|---|---|
"auto" |
May call a tool or return text | Conversational agents |
"any" |
Must call some tool, model picks which | Guaranteeing a call when the schema depends on input not yet known |
| Named-tool force | Must call that specific tool | Forcing execution order — e.g. an extraction step that must run before enrichment |
The discriminator: least privilege for the common case, with a scoped exception tool for genuine cross-role needs, rather than either over-provisioning (breaks separation of concerns) or batching every exceptional need through the coordinator (creates blocking dependencies and unnecessary latency).
"auto" is the default when a text response is acceptable. Once a call is required, the second question — is order being enforced, or is the right tool simply unknown in advance — separates a named-tool force from "any."