The Explain feature can't write, and neither can anything it spawns

Your product has an Explain button. It runs an agent workflow against the customer's container and returns a walkthrough of their code. It must never modify a file, whatever a prompt injection in a README says.

The workflow's step is marked read_only. That flag hard-gates the step to a read-only tool set, and the gate follows every subagent the step spawns. A delegated helper that decides to fix the typo while it's there has no write tool to call. The restriction isn't a system-prompt instruction the model could be argued out of; it's the absence of the tool.

You shipped a read-only agent feature without writing a read-only enforcement layer. The workflow definition carries the policy, and the daemon carries it out.

The safest tool to give an agent is the one it doesn't have.