When several tools can complete a task, an agent that picks the most powerful one holds more authority than the task needs. Recent work demonstrates that language-model agents do this often, and more so after a tool fails. Approaches to restrict focus so far on either enforcing least privilege outside the model or retraining the model. We ask a simpler question: does it help to tell the agent what each tool's privilege is? To investigate this question, we run all 544 ToolPrivBench scenarios on eight models, three run locally, and five through a hosted API, under five conditions: (1) no signal, (2) a least-privilege instruction, (3) privilege class and cost shown in each tool description, (4) both the instruction and privilege information, and (5) a matched neutral-metadata control. Showing privilege lowers premature escalation on every model that over-privileges at a measurable rate, reducing over-privileged selection by up to 19.3 percentage points (50\%), whereas irrelevant metadata in the same format does not. On most models, however, information alone mainly delays escalation until the standard tools have been tried. Combined with the instruction it more often avoids escalation, and the share of scenarios completed without a risk tool rises on seven of the eight models, reaching 51.1\% safe completion from a baseline of 18.8\% on the strongest-performing configuration. Visible privilege is therefore a cheap complement to enforcement rather than a substitute.

翻译：暂无翻译