Tool selection runs available → policy allowed → relevant → operationally valid → selected. Never relevant → authorised. Relevance only ever orders a set that policy has already approved.
Sending an agent your whole tool catalogue puts every money-moving and destructive operation one hallucination away on every request. On a 60-tool catalogue the naive baseline exposed 21 dangerous tools on all 38 benchmark tasks — 798 exposures. Policy filtering takes that to zero, structurally, because the filter runs before ranking.
The same filter cut schema tokens from 3,775 to 809 per request, and ranking took it to 292. Most of that saving is the policy layer, not the ranker — a distinction worth knowing before investing in clever retrieval.
Cumulative spend is checked before reservation and before every billable fallback, not once per request. A per-execution ceiling bounds one call and says nothing about ten thousand of them, which is how a runaway loop actually spends money.
Every tool call the model proposes is validated at call time against that tool's JSON Schema, and a call naming a tool the request never selected is rejected rather than passed through as an authorised proposal. Tool output enters the conversation framed as its own role, never as instructions. What is NOT built is an active defence against prompt injection carried inside that output, so destructive and write tools stay disabled during beta — a control plane that ships an unfinished guardrail is worse than one that says the guardrail is missing.