Comment by azurewraith

You've touched on the core issue... prompt based orchestration is non-idempotent. Same input, different orchestration paths every run. I've had better experience enforcing tool restrictions in discrete phases with deterministic code over orchestrating via LLM. Prompt level instructions get ignored, it's much harder to ignore a protocol-level tool restriction. It's simple and yet oddly VERY effective.