Your Agent's Tool Layer Is a Public API. Design It Like One.

The first agent I put in front of real users had eleven tools and a system prompt that said "ask for confirmation before doing anything destructive." It worked…