How do you handle side-effectful tools and secrets? Least-privilege and auditing seem hard once any Python function can become a tool (scoped creds, revocation, logs).
I'd prioritize audit logs + correlation IDs, and short-lived creds per tool call. Do you expose tool capabilities to the planner without exposing creds?