Deterministic verifiers matter here, because the model is not grading its own restraint.

What did they compare against for the privilege reduction metric, a straight prompt change, tool-call schema constraints, or a separate policy layer that blocks obvious overreach after the fact? For agent work, those baselines usually tell you whether the model learned restraint or just got put in a narrower box. The other question I wanted answered is what happens on distribution shift, especially when the task needs a missing permission once in a while, because a least-privilege policy that is safe on the training tasks can still be brittle if the tool set or terminal environment changes. Did they test whether the model starts compensating by making more indirect requests, longer command chains, or retries that leak the same capability through a different path?