The matter agent has no tool that leaves the room

Rule 1.6 doesn't care that the leak was a tool call. A research agent that can fetch a URL can also post the client's term sheet to one.

The matter agent's frontmatter tools line is set once: PATCH /api/v1/agent/agents/matter-4417/tools with read_file, search_code, git_diff: no fetch, no shell. GET /sessions/{id}/tools returns the effective set for any live session, so the allowlist is auditable, not assumed. Underneath, the matter container runs type: block networking, enforced on the host, where the agent can't add a route.

Two layers say the same thing in different languages: the agent has no verb for "send," and the container has no road out. Granting a tool back for one afternoon is POST …/tools/{tool}/toggle, and removing it is the same call.