Bounding Tool Agency With Least Privilege