Tool selection runs available → policy allowed → relevant → operationally valid → selected. Never relevant → authorised. Relevance only ever orders a set that policy has already approved.
Sending an agent your whole tool catalogue puts every money-moving and destructive operation one hallucination away on every request. On a 60-tool catalogue the naive baseline exposed 21 dangerous tools on all 38 benchmark tasks — 798 exposures. Policy filtering takes that to zero, structurally, because the filter runs before ranking.
The same filter cut schema tokens from 3,775 to 809 per request, and ranking took it to 292. Most of that saving is the policy layer, not the ranker — a distinction worth knowing before investing in clever retrieval.
Cumulative spend is checked before reservation and before every billable fallback, not once per request. A per-execution ceiling bounds one call and says nothing about ten thousand of them, which is how a runaway loop actually spends money.
Call-time argument validation and untrusted-output handling are not built. Destructive and write tools stay disabled during beta — a control plane that ships an unfinished guardrail is worse than one that ships none.