Treating search as a ranker and not an authorization layer is a good catch. What the model sees shapes what it tries, so I'd rather it never see a tool it can't use. Thanks for including what broke along the way.