Least privilege for tools
The model choosing which tool to call is not an authorisation decision, because the model is the part the attacker can reach. Authority belongs to the state the agent is in, not the sentence it just read.
Not yet
This one opens once you have finished Memory and RAG.
Progress is kept against your account, so finishing a module needs one. Everything up to here is open without.