Give the agent only what it needs. Enforce it structurally, not by asking nicely.
ALARA for agents (arXiv:2603.20380): borrowing from radiation safety (“As Low As Reasonably Achievable”), scope each agent's tool access and context to the minimum its role requires. Not through prompt instructions — through structural enforcement. A declarative context-agent-tool (CAT) specification defines what each agent can see and do. The shell (npcsh) enforces these boundaries as hard constraints, not behavioral suggestions.
Tested across 22 locally-hosted models (0.6B to 35B parameters), approximately 2,500 executions, 115 practical tasks spanning file operations, web search, multi-step scripting, tool chaining, and multi-agent delegation.
The structural insight is in the distinction between behavioral and structural enforcement. Telling an agent “you should only access files in this directory” is a behavioral instruction — the agent can comply or not, depending on its training, its context, and its alignment. Structurally preventing the agent from accessing files outside the directory makes the constraint inviolable. The first approach works when the agent is cooperative. The second works when it isn't — which is when you need it most.
This directly parallels the Unix permission model: users don't voluntarily stay within their file permissions; the kernel enforces the boundaries. Multi-agent systems need the same architecture — permissions enforced at the infrastructure layer, not the application layer. The CAT specification is the /etc/passwd of agent systems: a declarative description of capabilities that the runtime enforces whether the agent agrees or not.