Give models narrow tools, not raw access.
Three named tools make a boundary structural; broad access plus a well-behaved prompt only makes it a hope.
The evidence
Health data reached the model through an MCP server over stdio exposing purpose-built tools — trends, consult notes — rather than a database connection. In a shipped product, not a demo.
The convenient thing is to hand a model broad access and prompt it to behave. The auditable thing is to hand it three named tools and let the boundary be structural. Only one of those survives a question about what the system can reach, and only one of them is still true after a prompt gets edited.
The cost is real: every capability has to be designed and named. That cost is the point.