---
title: Giving an agent a shell is not the same as giving it a tool
series: teardown
type: teardown
published: 2026-09-06
author: tim
confidence: medium
project: authority-compiler
tags:
  - sandboxing
  - tool-design
  - agent-systems
exposure:
  basis: architecture-analysis
tested_with: []
domains:
  - agent-systems
  - runtime-infra
  - trust-boundary
thesis: A general shell exposes ambient authority, while a narrow tool makes scope, auditability, and verification part of the interface.
---

A shell is convenient because it can eventually perform almost any operation.
That convenience is also the abstraction leak: scope, credentials, side
effects, audit trails, and rollback are left implicit in a command string.

A narrow tool makes those concerns visible. Its inputs can describe a resource
and an intended operation; policy can decide whether that operation is allowed;
the runtime can constrain and record it; a verifier can observe the result.
Sandboxing and short-lived credentials can still matter, but they have a clear
boundary to protect.

This is a conceptual teardown of the interface choice, not a hands-on report.
It does not claim a specific shell experiment, installable SDK, or tested
environment. The boundary is explored further in [Authority Compiler](/work/authority-compiler)
and [Long-Horizon Verification](/work/long-horizon-verification).