How to Safely Give AI Agents New Tools at Runtime
Most systems treat "let an agent gain new tools while it runs" and "stop an agent from doing damage" as two problems with two solutions: a tool registry plus an approval workflow, or a plugin marketplace plus a permission system added afterward.
In Stof, they're the same mechanism. A document can only reach what it has been given, so a tool that arrives at runtime is limited the same way everything else in the document already is. Not because a permission check ran, but because there's nothing else there to reach.