Just started working with the Anthropic Agent SDK and I'm a bit worried about the default tool permissions. When I create a new agent, it seems like all my registered tools are just... available. 😅

For a simple weather agent, I tested adding a file read tool and it could access anything. Shouldn't we be explicitly granting permissions per tool? Here's what my setup looks like:

```python
@tool
def read_file(path: str):
with open(path, 'r') as f:
return f.read()

agent = AnthropicAgent(tools=[read_file, get_weather])
```

Is there a built-in way to scope this that I'm missing? Coming from web dev, this feels like having no authentication on an API endpoint by default. What are others doing to lock this down?