Define named permission profiles, map every tool to a class, and enforce them outside the model with guardrails, approvals, and narrowed schemas.