Open-source agent tool access starts at the credential boundary
Handing an agent a Stripe key is a decision about where that key lives. The model's instructions are the least reliable part of the arrangement, since everything in a context window competes with them

